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I.  INTRODUCTION 

This  report  documents  results  of  the  redundant  strapped-down 
(strapdown)  Inertial  Navigation  System  (INS)  preliminary  design 
study  conducted  by  Litton  Industries  Guidance  and  Control  Systems 
division  under  contract  number  NASl-13847  for  the  NASA  Langley 
Research  Center  (LaRC) . This  study  is  part  of  the  LaRC  VTOL 
Automatic  Landing  Technology  (VALT)  program.  The  purpose  of  the 
VALT  program  is  to  foster  the  development  of  the  various  tech- 
nologies needed  by  the  VTOL  aircraft  in  an  intra-urban  setting. 
Low-cost,  highly  reliable  avionics  are  essential  for  the  economic 
viability  of  this  mode  of  transportation. 

One  means  of  achieving  lower  costs  for  both  VTOL  and  conventional 
aircraft  is  improved  integration  of  avionics  functions.  Cur- 
rently, there  is  considerable  interest  in  replacing  the  multiple 
flight  control  sensors  of  a typical,  modern  commercial  aircraft 
with  a skewed  array  of  strapdown  inertial  navigation  sensors, 
and  using  redundant  computers  to  perform  multiple  functions  such 
as  flight  control,  air  data,  and  strapdown  navigation.  Net  cost 
has  been  shown  to  be  less  than  current,  non- integrated  systems. 
Inertial  navigation  capability  is  thus  available  without  addi- 
tional cost.  This  integrated  avionics  approach  depends  upon 
redundancy  to  achieve  the  reliability  needed  in  flight  control 
loops.  VTOL  and  other  modern  aircraft  will  be  designed  to  depend 
upon  the  flight  control  avionics  for  their  flight  stability  in 
order  to  achieve  various  performance  and  economic  improvements. 
Thus,  flight  control  system  reliability  and  flight  safety  depend 
upon  integrated  avionics  reliability.  Thorough  analysis  of 
skewed  sensor  system  reliability,  then,  is  essential. 

This  redundant  strapdown  INS  preliminary  design  study  demonstrates 
the  practicality  of  a skewed  sensor  system  configuration  by 
means  of : 

• Devising  a practical  system  mechanization  utilizing  proven 
strapdown  instruments. 

• Thoroughly  analysing  the  skewed  sensor  redundancy  manage- 
ment concept  to  determine  optimum  geometry,  data  process- 
ing requirements,  and  realistic  reliability  estimates. 

• Implementing  the  redundant  computers  into  a low-cost, 
maintainable  configuration. 

• Providing  a practical,  maintainable  packaging  concept 
suitable  for  airline  use. 

• Estimating  system  size,  weight,  power  and  cost  for  a 
production  system  configuration. 
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The  redundant  strapdown  INS  design  is  founded  upon  proven  strap- 
down  gyros  and  accelerometers  used  in  Litton* s LN-50  developmental 
strapdown  system.  This  system,  undergoing  flight  test  at  the 
time  this  report  was  written,  is  proving  the  practicality  of 
strapdown  navigation  using  two-degree-of-freedom  ( TDF ) , tuned- 
gimbal  gyroscopes.  These  gyroscopes  are  an  extension  of  the  type 
of  instrument  used  on  a wide  variety  of  production,  gimballed 
inertial  systems  manufactured  by  Litton,  and  other  companies. 

They  employ  conventional,  non-exotic  techniques  very  close  to  a 
production  configuration. 

The  TDF  capability  of  these  tuned-gimbal  gyroscopes  is  partic- 
ularly suited  to  a redundant  system  configuration.  A fail- 
operational/fail-operational  (fail-op/fail-op)  system  can  be 
achieved  using  only  four  gyros  versus  six  single-degree-of- 
freedom  instruments.  Tuned-gimbal  gyro  costs  are  quite  low 
compared  to  present  forms  of  exotic  instruments , resulting  in  a 
particularly  low  cost  for  the  high-reliability,  redundant  system. 

The  compact  size  of  the  tuned-gimbal  gyro  lends  itself  to  a 
redundant  system,  resulting  in  a small  net  configuration.  This 
is  useful  in  solving  aircraft  installation  problems,  improving 
maintainability,  and  in  assuring  the  required  gyro-to-gyro  me- 
chanical alignment  stability  needed  for  accurate  strapdown 
navigation . 

The  preliminary  electronics  estimates  of  the  remaining  system 
constituents  are  based  on  current  technology.  Extensive  tech- 
nology extrapolations  are  not  employed.  The  size  and  cost  esti- 
mates presented  in  this  study  are  thus  very  realistic  for 
application  of  such  a system  into  airline  use  in  the  early  1980' s. 
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I I . SUMMARY 


2.1  General  Program  Description 

This  report  documents  the  preliminary  design  of  a J^un^*d_ 

The  fail-op/fail-op  navigator  designed  to  meet  these  requirements 
^ ctudv  has  been  configured  to  consist  of  four,  inter 
SanaeJbli  plug-L^StS  fcr9lowest  cost.  Each  unit  contains  one 
channel  of  hardware  consisting  of  a TDF  tuned  gimbal  gyro,  two 
linear  accelerometers,  a computer,  and  a power  supply. 

The  gyro/accelerometer  axes  are  skewed  within  each  chassis  so 

fTn  the  four  channels  are  installed  as  shown  in  figure  2-1, 
the  fouJwro,  eight  accelerometer  axes  are  distributed  in  space. 
This  distribution  assures  that  normal  operation  continues  regard- 
's of  which  two  sensors  fail.  A precision  alrgnment  bloch 
would  be  located  within  the  central  core  of  the array.  1 Thus, 
accurate  angular  registration  between  instruments  of  the  four 
channels  can  be  obtained  easily. 

Some  applications  may  require  a physical  separation 
channels  to  reduce  overall  system  susceptibility  to  a common 
disaster.  Other  solutions  to  this  susceptibility  are  preferred, 
however  such  as  proper  location  of  the  units  in  the  aircraft 
and/or  Structural  and  thermal  isolation.  If  these  ^thods  are 
not  adeauate,  the  four  channels  can  be  split  into  pairs  as  snown 
in  fiqu?e  2^2.  Stiffness  of  the  aircraft  must  be  assured  or  the 
Reliability  and  performance  of  the  second  fail-op  level  are 
significantly  degraded.  Added  software  is  also  needed  if  pre- 
cision boresighting  between  location  is  to  be  avoided.  is 

report  concentrates  on  the  preliminary  system  design  for  the 
stallation  method  of  figure  2-1. 

The  system  characteristics  for  the  full  fail-op/fail-op  redundant 
strapdown  INS  are  as  follows: 


Power: 

Weight: 

Dimensions: 


540  watts 

27.7  Kg  (61  pounds) 

0.33m  x 0.33m  x 0.36m 
(13"  x 13"  x 14") 
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Reproduced  from 
best  available  copy. 
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Figure  2~1 . Four  Channel  Installation  Configuration 
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Reproduced  trom 
best  available  copy. 

— •— t 


5 


figure  2 2*  Split-Sensor  Installation  Arrangement 
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Accuracy* : 

Reliability,  1 hour  flight 
Flight  control  outputs: 
Navigation  outputs: 

Cost  (production): 


1.03  m/sec  (2  knots) (95%) 

0.4  x 10-1° 

0.5  x 10"9 
$98,000 


A baseline  system  specification  is  included  as  Appendix  A of  this 
The  preliminary  design  of  the  redundant  strapdown  INS 
indicates  that  production  equipment  meeting  these  specifications 
could  be  available  in  the  early  1980  s. 


2.2  System  Description 

A simplified  system  block  diagram  for  the  redundant  strapdown 
INS  is  shown  in  figure  2-3.  The  complete  system  is  composed  of 
four1 identical  channels.  Each  channel  of  the  INS  consists  of 
the  following  elements: 

a An  Inertial  Measurement  Module  ( IMM)  containing  the 
basic  inertial  sensing  devices,  one  TDF  tuned  gimbal 
gyro  and  two  axes  of  acceleration  measurement,  with 
the  associated  electronics. 

b.  A computer  which  performs  redundancy  management,  instru- 
ment compensations,  coordinate  transformations,  an  e 
inertial  navigation  computations. 

c External  I/O  which  interfaces  the  computer  with  other 
* aircraft  equipment.  Note  that  there  is  no  self-contained 
voting  in  the  system  between  the  computers  and  these 
outputs.  The  external  equipment  must  perform  some 
voting  between  channels  (in  addition  to  using  validity 
information  provided  by  each  channel)  in  determining 
the  final  navigation  variable  to  be  used. 

d.  Inter- computer  I/O  which  is  used  to  transfer 

accelerometer  measurement  data  from  one  channel  to  a 
others  for  use  in  redundancy  management,  and  for  deriva- 
tion of  the  full  3-dimensional  rate  and  acceleration 

inputs . 

e A power  supply  used  to  drive  all  elements  in  a channel. 
Note  that  there  is  no  cross-feeding  of  power  between 


♦With  posit ion “updates  from  DME,  differential  Omega,  Loran  C,  or 
GPS. 
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Figure  2-3.  Redundant  Strapdown  INS 
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channels.  This  results  in  a simple,  low-cost  power 
supply  design  with  a negligible  decrease  in  system  reli- 
ability over  a modularly  redundant  power  supply 
conf igurat ion 

A more  detailed  block  diagram  for  one  of  the  four  Inertial  Navi- 
gation Modules  ( INM)  is  shown  in  figure  2-4.  The  equipment 
shown  is  packaged  in  its  own  chassis  and  four  of  these  chasses 
installed  into  a common  mount  comprise  the  complete  redundant 
strapdown  INS . 

G-6  Gyroscope  (Figure  2-5) 

The  baseline  gyroscope  for  the  production  program  is  designated 
the  G-6.  It  is  used  in  the  LN-50  program  and  has  proven  per- 
formance. The  design  is  based  on  the  production  Litton  G-1200 
gyro  used  in  the  LN-30  family  of  gimballed  inertial  navigation 
systems  and  the  LTN-72  commercial  system.  It  has  a considerably 
increased  torquing  rate  capability  (up  to  240°/sec)  to  be  suited 
to  strapdown  INS  usage.  A smaller,  lower-performance,  lower- 
cost  version  of  this  instrument  (designated  the  G-7)  is  currently 
under  development.  Its  applicability  to  LaRC  requirements  has 
been  considered  due  to  the  stringent  cost  goals  of  the  study 
program. 

Both  the  G-6  and  G-7  are  TDF , tuned  gimbal,  nonfloated  gyro- 
scopes. The  gyroscopic  element  is  attached  to  the  rotor  of  a 
synchronous  motor  by  means  of  two  pairs  of  flexible  hinges 
separated  by  an  intermediate  gimbal.  The  kinetic  forces  on  the 
gimbal  when  rotating  at  operating  speed  are  designed  to  cancel 
the  hinge  torques  occurring  at  normal  gyroscope  displacement 
angles.  Thus  the  gyroscope  is  capable  of  accurately  measuring 
the  extremely  small  angular  rates  required  for  inertial 
navigation. 

Electromagnetic  pick-offs  are  provided  to  sense  displacements 
between  the  gyro  case  and  the  gyroscope  rotating  wheel.  These 
pick-off  outputs  are  then  used  in  electronic  circuitry  to  pre- 
cess  the  gyro  wheel  to  null  the  displacement  in  a high-speed, 
closed  loop. 

Gyro  precession  is  produced  by  a pair  of  electromagnetic  torquers 
attached  to  the  gyro  case,  acting  against  a permanent  magnet 
on  the  rotating  wheel.  The  amount  of  current  in  the  torquers 
required  to  keep  the  pick-offs  nulled  is  the  measure  of  vehicle 
angular  rate  about  the  two  torquing  axes.  Special  design  features 
are  provided  in  the  torquing  mechanization  so  that  the  torquing 
current  accurately  represents  precession  rate  over  the  wide 
dynamic  range  appearing  in  a strapdown  INS. 
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Figure  2-5.  G-6  Gyroscope  and  A- 1.000  Accelerometer 
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A-1000  Accelerometer  (Figure  2-5) 

The  baseline  accelerometer  selected  for  the  production  program 
is  designated  the  A-1000.  It  is  a single-degree-of-f reedom 
instrument  used  in  the  production  LN-30  gimballed  inertial  navi- 
gation systems,  the  LTN-72  commercial  gimballed  systems,  and  the 
LN-50  strapdown  navigation  program.  Minor  modifications  are 
made  to  the  external  instrument  circuitry  when  used  in  the  strap- 
down  program  to  provide  for  digital  rebalance  instead  of  the 
normal  analog  rebalance. 

The  A-1000  accelerometer  is  a flexible  hinge  (dry) , torque-to- 
balance  instrument.  It  has  a capacitive  pick-off  to  detect 
rotations  of  the  rotary,  pendulous  sensitive  element.  Pick-off 
deflections  are  then  used  in  external  electronics  to  produce 
current  in  an  electromagnetic  permanent  magnet  torquer  in  the 
accelerometer  to  drive  the  pick-off  to  null.  The  torquer  current 
is  then  a measure  of  vehicle  acceleration  normal  to  the  pendulous 
and  rotary  axes. 

Gyro/Accelerometer  Rebalance  Electronics 

Each  of  the  gyro  and  accelerometer  rebalance  electronics  takes 
essentially  the  same  form,  as  shown  in  figure  2-4.  The  gyro 
loops  have  more  difficult  requirements  so  the  following  loop 
description  and  design  criteria  will  be  directed  towards  their 
concepts.  Accelerometer  loops  are  somewhat  simpler  but  with 
wider  bandwidth. 

The  gyro  pick-offs  are  amplified,  demodulated  from  their  54  KHz 
carrier,  and  the  resultant  is  further  amplified  with  frequency 
compensation.  This  compensation  provides  appropriate  character- 
istics when  the  loop  is  closed  through  the  gyro  torquer.  When 
the  output  of  the  compensation  amplifier  crosses  a threshold, 
the  duty  cycle  of  a switched,  constant-current  supply  is  modified 
proportionately  to  change  the  gyro  torquing  level.  This  closed 
loop  system  is  designed  to  be  of  a wide  bandwidth  within  the 
capability  of  the  gyroscope  (approximately  80  Hz),  and  thus 
provides  an  accurate  representation  of  vehicle  angular  rates 
during  normal  vehicle  vibration.  Dynamic  errors  which  might 
occur  during  such  vibration  may  then  be  compensated  in  the 
computer. 

Designed  in  this  manner  ( fixed- frequency  square  wave,  duty-cycle 
modulated),  the  loop  design  is  linear  and  well-behaved.  An 
excellent  incremental  angle  resolution  of  0.5  arc  seconds  is 
achieved.  Furthermore,  loop  compensation  design  is  much  simpler 
than  for  nonlinear  systems.  High  noise  methods  such  as  lead 
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networks  and  cross-coupled  loops  can  be  avoided  in  the  stabiliza- 
tion of  gyro  nutation  and  for  the  elimination  of  spin-frequency 
pick-off  noise. 

The  switch  which  injects  a constant  current  of  alternating 
polarity  into  the  gyro  torquer  is  carefully  designed  to  achieve 
exactly  equal  current  in  each  direction.  Imbalance  of  current 
leads  to  an  equivalent  gyro  drift  which  is  proportional  to  the 
maximum  current  supplied.  To  further  decrease  the  electronics 
contribution  to  gyro  drift,  a mode  change  is  incorporated  which 
increases  the  current  by  a factor  of  8 at  high  vehicle  angular 
rates.  Thus,  during  normal  flight,  the  dynamic  range  of  gyro 
torquing  (the  ratio  of  maximum  vehicle  rate  to  maximum  allowable 
sensor  rate  error)  is  reduced  for  improved  performance. 

Temperature  Sensitivity  Correction 

The  gyro  and  rebalance  electronics  parameters  are  designed  to 
have  low  sensitivity  to  operating  temperature.  There  are  limits 
to  how  insensitive  these  devices  can  be  made,  however.  The 
residual  coefficients  are  sufficiently  stable  with  time  so  that 
the  net  system  error  budget  can  be  achieved  either  with 

• monitoring  of  component  operating  temperature,  with 
computer  corrections  applied  using  factory-calibrated 
coefficients,  or 

• rapid  component  warmup  and  temperature  control. 

The  advantages  of  the  calibration  method  are: 

• system  power  consumption  is  reduced 

• component  operating  temperature  is  lower,  resulting  in 
improved  reliability. 

Additional  benefits  derived  from  avoiding  a large  thermal  tran- 
sient at  turn-on  are:  1)  Electronics  failures  are  often  induced 

by  the  stresses  associated  with  large  thermal  gradients,  so  net 
reliability  is  further  improved  over  straight  parts-count  con- 
siderations: 2)  A thermal,  and  thus  instrument  performance 

transient  during  ground  alignment  is  eliminated.  Such  a transient 
can  seriously  contaminate  gyro compassing  if  not  controlled.  The 
instrument/electronic  thermal  design  becomes  very  critical  in 
temperature-controlled  systems  so  that  transients  are  completed 
soon  enough  to  achieve  alignment  in  the  required  10  minutes. 

Increased  calibration  costs  result  with  this  method,  however, 
since  instrument/electronic  constants  must  be  derived  at  a number 
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of  temperatures  instead  of  at  a single  point.  Test  equipment 
complexity,  test  time,  and  the  number  of  testers  needed  for 
significant  production  rates  are  all  increased. 

The  final  tradeoff  of  whether  or  not  to  temperature-control 
instruments  is  left  until  the  final  production  equipment  design. 
System  design  is  described  for  a compensated  implementation. 

Inertial  Instrument/Computer  Interface 

The  interface  between  the  inertial  instruments,  the  gyros  and 
accelerometers,  and  the  digital  computer  is  shown  in  the  block 
diagram  of  figure  2-4.  Four  of  the  inputs  are  the  duty-cycle 
modulated  squarewaves  from  the  gyro  and  accelerometer  digital  re- 
balance loops.  An  indication  of  high  rate  mode  is  also  required 
to  change  pulse  weighting. 

The  conversion  of  duty-cycle  modulated  square— waves  to  a parallel 
digital  word  for  entry  into  the  computer  is  performed  by  up-down 
counters.  While  gyro  or  accelerometer  torquer  current  is  posi- 
tive, the  count  in  a register  increments  at  some  fixed  clock 
rate.  When  torquer  current  switches  negative,  the  register  count 
decrements.  The  net  counter  value  over  one  digital  torquing 
interval  (approximately  500  microseconds  for  gyros,  250  microsec- 
onds for  accelerometers ) is  representative  of  the  angular  change 
of  the  vehicle  about  that  axis  during  the  interval  for  gyros, 
and  velocity  change  for  accelerometers.  No  unusual  design  tech- 
niques are  needed  for  this  function  since  clock  rates  of  approxi- 
mately 400  kHz  can  be  employed.  The  main  constraint  is  that  the 
digital  rebalance  duty-cycle  transition  occurs  only  at  one  of 
the  counter  clock  pulses  so  that  no  information  is  lost. 

Temperature  sensors  are  installed  at  the  instruments  for  computed 
compensations.  These  sensors  are  platinum  resistance  elements 
put  into  a bridge  circuit , the  outputs  of  which  are  dc  voltages 
proportional  to  temperature.  Thus  a 10-bit  analog- to-digital 
converter  is  needed  to  develop  the  digital  words  for  application 
to  the  computer  data  bus. 

Since  the  digital  rebalance  circuits  have  their  own  sensitivity 
to  temperature,  gradients  between  the  gyro  temperature  sensor 
and  the  thermally  sensitive  electronic  components  with,  for 
example,  different  cooling  air  flows  must  also  be  considered. 
Adding  a temperature  sensor  to  the  electronics  implies  that  in- 
struments and  electronics  are  calibrated  at  the  factory 
separately.  This  not  only  increases  cost,  but  also  may  be 
impractical  due  to  the  accuracy  requirements.  Therefore, 
sensitive  portions  of  rebalance  electronics  will  be  closely 
packaged  with  their  corresponding  instruments  to  assure  a common 
thermal  environment,  and  then  will  be  calibrated  together. 
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Digital  Computer  Design 

A specific  digital  computer  was  not  selected  for  the  production 
redundant  strapdown  INS.  There  are  two  reasons  for  this  decision. 

• Digital  computer  technology  is  evolving  so  rapidly  that 
lowest  system  cost  can  be  achieved  by  making  such  a 
choice  when  production  system  detailed  design  is  started. 
Cost  and  reliability  estimates  for  the  preliminary 
design  are  made  based  on  use  of  components  recently 
announced  in  the  literature  with  price  extrapolation. 

• The  primary  use  of  a redundant  strapdown  INS  is  in  a 
highly  integrated  avionics  suit.  Therefore,  computer 
duty  cycle  and  memory  margin  are  needed  for  other 
functions  such  as  flight  control  and  display.  A firm 
computer  choice  cannot  be  made  until  these  other  func- 
tions are  delineated. 

The  redundant  strapdown  computation  requires  approximately  8000 
words  of  memory.  Throughput  requirement  is  approximately  198  000 
instructions  per  second.  Modern  digital  computers  employing 
features  such  as  microprogrammability,  general  registers,  vectored 
hardware  interrupts,  floating  point,  DMA,  etc.  are  available  with 
more  than  adequate  speed.  32-bit  arithmetic,  including  multi- 
plication, is  highly  desirable. 

A combination  ROM/RAM  semiconductor  memory  was  chosen  for  lowest 
cost.  This  choice  is  based  on  the  assumption  that  few  software 
changes  will  be  needed  once  the  program  is  de-bugged.  This 
assumption  is  valid  for  the  LaRC  problem  as  defined  since  the 
redundant  strapdown  INS  is  basically  a sensor.  If  functions  such 
as  steering,  flight  control,  or  display  are  added,  these  would 
generally  change  from  aircraft  to  aircraft.  Therefore,  higher- 
cost  approaches  such  as  all-RAM,  EAROM,  EPROM,  or  core  would 
need  to  be  considered. 

The  RAM  chosen  is  of  the  CMOS  type.  The  lower  power  dissipation 
of  CMOS  allows  the  addition  of  a small  battery  which  prevents 
loss  of  memory  (self-test  data,  modified  calibration  values, 
initial  position)  during  power  shutdown.  A high  speed  construc- 
tion technique  such  as  Silicon-on-Saphire  (SOS)  is  needed  to 
maintain  throughput. 

A PROM  is  also  included  which  stores  factory— derived  instrument 
coefficients  such  as  bias,  scale— factor , g— sensitivity , etc.  It 
is  read  out  by  the  computer  at  the  start  of  every  flight.  It  is 
programmed  only  at  the  factory  or  repair  depot  following  system 
calibration. 
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Computer  I/O 

Input/output  format  between  each  redundant  strapdown  INS  computer 
and  external  avionics  has  been  assumed  to  be  in  a serial  format 
commonly  used  by  commercial  aircraft,  ARINC— 575.  This  format  is 
clearly  subject  to  change  in  future  avionics.  The  low  bit-rate 
(approximately  10  kHz)  is  quite  marginal  for  modern-day,  digital 
avionics.  I/O  cost,  however,  was  felt  to  be  representative.  A 
failure  output  discrete  is  also  planned,  in  addition  to  the 
serial  data,  to  inform  external  equipment  and  failure  annuncia- 
tors of  channel  failure  condition. 

The  internal  I/O  consists  primarily  of  computer-to-computer  data 
transfer.  During  normal  operation  the  data  to  be  transferred 
between  computers  is  relatively  light,  consisting  basically  of 
corrected  instrument  measurement,  6 words  at  a rate  of  128  times 
per  second.  Initialization  modes  are  provided  to  correct  one 
potentially  erroneous  computer  with  a known  good  one  following 
a pre-flight  channel  replacement  and  following  some  instrument 
failures.  A transfer  of  about  75  words  of  the  variable-data 
memory  would  then  be  required. 

Data  transfer  is  shown  in  figure  2—4  as  a read-only  function  from 
the  RAM.  This  assures  that  failure  of  one  of  the  three  other 
INM  computers  cannot  cause  destruction  of  RAM  data.  Since  in- 
struction storage  is  in  unmodifiable  ROM,  the  possibility  of 
multiple-channel  instruction-sequencing  failure  modes  is 
precluded. 

Serial  data  transfer  between  channels  is  preferred  due  to  the 
reduced  connector/wiring  requirements.  Data  transfer  rates  must 
be  high  enough  to  achieve  the  above  initialization  timing.  Bit 
rates  of  1 to  2 MHz  are  practical  with  present  technology. 

Interrupt  Synchronization 

The  software  in  each  computer  is  driven  by  an  external  interrupt 
occurring  once  for  each  fast  cycle  (128  per  second).  Since  gyro 
and  accelerometer  data  are  transferred  between  computers  and 
time-coherence  of  samples  is  required,  each  computer  must  start 
its  fast  cycle  at  the  same  time.  Circuitry  is  needed  to  lock  the 
four  interrupt  pulse  generators  together.  In  addition,  the  cir- 
cuit design  must  be  protected  so  that  failure  of  circuitry  in 
one  interrupt  generator  does  not  cause  failure  in  any  other 
unit's  interrupt  and  deactivate  its  computer. 

Power  Supply 

The  INM  power  supply  design  is  conventional,  based  primarily  on 
use  of  a converter-regulator  and  switching  regulators  for  high 
power-utilization  efficiency.  Primary  power  is  assumed  to  be 
115v,  400  Hz  from  one  of  the  aircraft  generator  busses. 
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One  relatively  high-voltage  supply  (80  volts)  is  needed  to 
generate  the  high  temporary  currents  needed  when  gyro  rebalance 
loops  switch  into  the  high  rate  mode. 

Software 

The  software  organization  for  the  four-computer  system  is  shown 
in  figure  2-6.  Gyro  and  accelerometer  data  are  requested  via 
the  I/O . Static  and  dynamic  compensation  are  then  applied  as 
follows : 

Accelerometer  Compensation 

a.  Scale  Factor 

b.  Axis  alignment 

c.  Bias 

Gyro  Compensation 

a.  Scale  factor  (normal/high  rate) 

b.  Torquer  axis  transformation 

c.  Inertial  compensation 

d.  Spin  axis  alignment 

e.  G-Sensitive  drift 

f.  Bias 

Following  compensation  and  transformation  from  skewed  instrument 
coordinates  to  aircraft  body  coordinates,  the  corrected  gyro  and 
accelerometer  data  are  available  for  use  by  other  channel 
computers.  Note  that  each  computer  compensates  only  one  gyro. 
Thus,  the  selected  redundant  configuration  has  a lower  computer 
throughput  requirement  than  a nonredundant  (2-gyro)  strapdown 
system.  The  inertia  compensation  must  be  performed  at  high  rates 
to  be  effective  so  is  very  significant  in  duty  cycle  calculations. 

The  FDI  equations  accept  data  from  the  four  (or  three  during 
failure  modes)  gyros  and  up  to  8 accelerometer  axes  for  failure 
detection,  isolation,  and  system  reconfiguration.  The  selected 
instrument  axis  orientation  is  shown  in  figure  2-7.  Spin  axes 
are  configured  normal  to  faces  of  one-half  of  an  octahedron, 
represented  by  the  pyramid  constructed  from  equilateral  triangles. 
Gyro  torquer  axes  and  accelerometer  input  axes,  x.,  y.,  are  also 
shown . 1 1 
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Parity  equations  are  derived  by  comparing  one  gyro's  rate 
measurement  with  another's  along  a direction  eij  parallel  to  the 
intersection  of  the  two  gyro  measurement  planes.  Since  the  gyro 
measurement  planes  are  on  the  faces  of  the  octahedron,  the  edges 
of  the  octahedron  are  these  intersections.  Thus,  two  gyro 
measurements  of  the  same  component  of  vehicle  angular  rate  can 
be  directly  compared  to  detect  errors. 

Six  unique  parity  equations  T^j  are  available  as  shown  in  figure 
2-7.  If  two  or  more  equations  involving  a specific  gyro  indicate 
an  error  condition,  that  gyro  is  classified  as  failed.  After 
one  gyro  failure,  only  three  equations  remain.  The  " two-or-more" 
criterion  still  applies,  however.  A more  sophisticated  detection/ 
isolation  method  is  presently  under  consideration  and  will  be 
described  in  Paragraph  5.3. 

Processing  of  a parity  equation  involves  an  imperfect  integration. 
For  very  small  nonfailure  gyro  drift  errors,  the  output  remains 
below  the  error  detection  threshold.  The  threshold  may  thus  be 
kept  constant  as  a function  of  time.  For  large  drift  errors,  the 
output  is  essentially  an  angle.  Thus, angular  transients  to  the 
flight  control  system  during  failure  modes  can  be  kept  below  a 
desired  level. 

Design  equations  form  a least-squares  solution  of  the  angular 
rates  from  two  gyros  (format  is  similar  for  accelerometers)  to 
derive  three  orthogonal  axes  of  data  from  four  measurement  axes. 
The  logic  for  selection  of  instruments  to  be  used  in  the  design 
equations  is  shown  in  figure  2-6.  When  all  four  channels  are 
operating  normally,  channel  1 design  equations  use  instrument 
data  from  channels  1 and  2.  If  channel  2 is  determined  to  be  in 
error  by  parity  equations,  instrument  data  from  channels  1 and  3 
are  used,  etc. 

The  resultant  rates  and  acceleration  data  are  then  processed  by 
the  coordinate  converter  to  determine  aircraft  body  angles  rela- 
tive to  the  inertial  navigation  coordinate  system  and  to 
convert  body  accelerations  into  that  system.  A partial  5th 
order  quaternion  integration  algorithm  is  employed. 

The  basic  inertial  navigation  equations  are  of  a relatively  con- 
ventional form,  and  include  provisions  for  rapid  ground  align- 
ment with  optimally-derived,  time-varying  coefficients.  Inertial 
angular  rates  are  derived  based  on  alignment  equations  on  the 
ground,  or  vehicle  position  and  velocity  during  flight  to  correct 
the  body-to-computer  axis  quaternions. 
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The  computation  rates  for  the  various  software  modules  will  be 
as  follows: 


Gyro  compensation 

128/sec 

Accelerometer  compensation 

128/ sec 

Parity  equations 

128/sec 

Design  equations 

64/ sec 

Quaternion  integration 

64/ sec 

Coordinate  transformation 

64/ sec 

Outputs 

32/sec 

Navigation 

8/  sec 

Alignment 

8/  sec 

Table  2-1  lists  the  major  software  FDI  features  recommended  as  a 
result  of  the  study.  Table  2-2  gives  a conservative  estimate  of 
word-count  and  duty  cycle  requirements  for  the  baseline  computer. 
Various  means  of  reducing  computation  time  will  be  investigated 
during  system  final  design.  They  include  reduction  of  compen- 
sation and  quaternion  integration  iteration  rates  by  a factor  of 
two,  and  use  of  special  microprogrammed  instructions. 

TABLE  2-1.  FAILURE  DETECTION,  ISOLATION,  SWITCHING  CONCLUSIONS 


• PROCESS  EACH  PARITY  EQUATION  WITH  SIMPLE  LOW-PASS 
FILTER 

• USE  TABLE  LOOK-UP  OR  LOGIC  EQUATIONS  FOR  FAULT 
ISOLATION 

• CONSIDER  ADDITION  OF  PROCESSED  PARITY  EQUATIONS  FOR 
TIGHTER  DETECTION  LEVELS 

• EQUATIONS  AND/OR  SWITCHING  LEVELS  SHOULD  BE  MODIFIED 
BETWEEN  GROUND  ALIGNMENT,  NORMAL  AND  MANEUVERING 
FLIGHT  SINCE  ERROR  MODEL  CHANGES 

• CONTINUE  MONITORING  SOFT-FAILED  GYRO. 

• CONSIDER  USE  OF  SOFT-FAILED  GYRO  FOR  THIRD  FAIL-SAFE 
OR  TO  RESOLVE  3 -GYRO  ISOLATION  AMBIGUITY 

• TREAT  ACCELEROMETER  AND  GYROS  AS  BEING  INDEPENDENT 
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TABLE  2-1.  FAILURE  DETECTION,  ISOLATION,  SWITCHING 

CONCLUSIONS  (Cont) 


• IF  ONE  AXIS  OF  A CHANNEL  FAILS,  SWITCH  OUT  BOTH  AXES 

• CONSIDER  REINITIALIZATION  FOLLOWING  ANY  SWITCHING 

• CONSIDER  COMPARISON  BETWEEN  OUTPUT  TABLES  IF  SOFT- 
WARE, AND  REINITIALIZATION  IF  SIGNIFICANT  ERROR  IS 
DETECTED.  ACCOUNTS  FOR  COMPUTER  TRANSIENT  ERRORS 
BETWEEN  INSTRUMENT  COMPARISONS  AND  OUTPUT  FORMULATION 

• USE  RADIO  AID  UPDATES  TO  DETECT  SMALL  ERRORS  OR  TO 
RESOLVE  3 -GYRO  ISOLATION  AMBIGUITY 


TABLE  2-2.  COMPUTER  RESOURCE  ESTIMATES 


TASK 

DUTY 

CYCLE  (%) 

MEMORY 

RATE  (Hz) 

COMPENSATION  - FAST 

15.2 

500 

128 

COMPENSATION  - SLOW 

0.3 

200 

2 

FDI  - DESIGN  EQN 

16.6 

700 

128 

COORDINATE  CONVERTER 

15.9 

750 

64 

NAVIGATION  - FAST 

2.1 

650 

8 

NAVIGATION  - SLOW 

2.1 

300 

2 

ALIGNMENT  GAIN  SELECT 

0.1 

100 

1 

MODE  CONTROLLER 

0.7 

600 

1 

BARO-ALT ITUDE 

0.1 

150 

2 

EXECUTIVE-SCHEDULER 

4.8 

250 

128 

OUTPUT  FORMATTER 

2.1 

200 

32 

DATA  BASE  - SUBROUTINES 
TOTALS 

60.0 

2000 

6400 
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Accuracy/ Input -Output 

The  redundant  strapdown  INS  will  have  the  following  output 
accuracy: 


Attitude  rate 


0.05°/sec,  ms,  per  axis 


Attitude 
Heading,  True 
Position  Rate 


Acceleration 


0 . 1 ° , rms , per  axis 

0.2°,  rms,  0.5  hr.  flight 

1.03  m/sec  (2  knots) (95%)  radial 
with  external  updates  every  5 sec., 
update  noise  of  122m  rms,  zero 
correlation  time,  61m,  rms,  20 
sec  correlation  time  per  axis, 

30  minutes  flight  duration 

0 .003m/ sec2 


This  accuracy  applies  with  either  0,  1,  or  2 hardware  failures, 
and  through  the  required  operational  environment.  It  is  assumed 
that  aircraft  installation  errors  are  not  included,  aircraft 
parking  coordinates  have  been  entered  perfectly  and  a full  gyro- 
compassing  alignment  has  been  completed  in  10  minutes  after 
turn-on,  at  a latitude  of  45°  prior  to  first  aircraft  motion. 

The  system  error  expected  per  channel  is  illustrated  in  figures 
2-8  and  2-9.  The  simulations  are  based  on  a realistic  error 
budget  and  show  50  percent  probability  errors  with  and  without 
radio  aid  updating.  Aided  performance  is  essentially  1 m/sec 
(95%)  as  required. 

Outputs  provided  by  the  redundant  strapdown  INS  are  as  follows: 


Category 

Quantity 

Resolution 

Range 

Bits 

Cycle  Time 

Pitch 

( Elevation) 

2n/215 

±7t/2* 

14 

0.031  sec 

Attitude 

Roll 

2n/215 

± 7T 

15 

0.031  sec 

Heading , 
true 

2n/215 

± 7T 

15 

0.031  sec 

Pitch  rate 

0 . 05  °/sec 

±4  rad/ 
sec 

14 

0.031  sec 

Attitude 

Rate 

Roll  rate 

0 . 05 “/sec 

±4  rad/ 
sec 

14 

0.031  sec 

Yaw  rate 

0 . 05 “/sec 

±4  rad/ 
sec 

14 

0.031  sec 
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Figure  2-8.  Simulation  Results  of  50  Percentile 
and  Position  Error  with  Radio  Updates 


Figure  2-9.  Simulation  Results  of  lo  and  50%  Velocity  and  Position 

Errors,  Free  Inertial 
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Category 

Quantity 

Resolution 

Range 

Bits 

Cycle 

Time 

Longitudinal 

0.003  m/ 

±10  g 

11 

0.031 

sec 

Accel . 

sec2 

Body** 
Accel . 

Lateral 
Accel . 

0.003  m/ 
sec2 

±10  g 

11 

0.031 

sec 

Vertical 

0.003  m/ 

±10  g 

11 

0.031 

sec 

Accel . 
( Body ) 

sec2 

North 

0.03  m/ 

±1686 

16 

0.125 

sec 

Velocity 

sec 

m/sec 

East 

0.03  m/ 

±1686 

16 

0.125 

sec 

Nav 

Velocity 

sec 

m/sec 

Output  s 

Vertical 

0.03  m/ 

±1686 

16 

0.125 

sec 

Velocity 
( Earth ) 

sec 

2n/219 

m/sec 

Latitude 

±rr/2* 

18 

0.125 

sec 

Longitude 

2n/219 

±7T 

19 

0.125 

sec 

Altitude 

0.3m 

-305m  to 
18 . 3 km 

16 

0.125 

sec 

*These  outputs  are  generally  scaled 

at  ±w. 

**Installation  is  assumed  to  be  at  the  aircraft 

center  of 

gravity , 

so  lever-arm  accelerations  are  not  included. 

An  output  line  indicating  failure  of  one  or  more  system 
components/subsystems  will  be  provided  from  each  redundant 
computer . 

Input  requirements  consist  of  altitude  from  an  air-data  system 
and  update  data,  for  example,  Kalman  filter  updates  based  on 
VOR/DME  or  OMEGA  data.  Baseline  update  quantities  are  2 velocities 
and  2 position,  (4  total)  at  a rate  of  one  full  update  at  least 
every  30  seconds.  Additional  inputs,  TBD,  will  be  received  from 
a display. 

Packaging  Description 

The  complete  redundant  strapdown  INS  consists  of  4 identical 
inertial  navigation  modules  plugged  into  a common  mount.  One  of 
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the  inertial  navigation  modules  is  illustrated  in  figures  2-10. 

It  consists  of  the  chassis,  power  supply,  electronics  cards,  and 
an  instrument  block,  and  has  a weight  of  approximately  5.9  Kg 
Cooling  is  assumed  to  be  direct  impingement  of  cabin  air  on  the 
components,  so  no  heat  exchanger  is  required. 

The  instrument  block  is  attached  to  the  chassis  by  means  of  a 
lever  mechanism.  When  the  chassis  is  plugged  into  the  common 
mount,  a plunger  pushes  on  the  engagement  lever  causing  the  block 
to  move  so  the  alignment  feet  can  engage  a central  alignment 
block  in  the  mount.  This  mechanism  provides  for  angular  align- 
ment accuracy  of  10-20  arc  seconds  between  the  four  instrument 
blocks  of  the  entire  system.  Each  instrument  block  consists  of 
one  G-6  Gyro,  two  A-1000  Accelerometers,  and  an  electronics 
card,  as  shown  in  figure  2-11. 

The  mount  chassis  shown  in  figure  2-10  forms  a common  shell  for 
the  four  inertial  navigation  modules.  The  mount  chassis  weight 
is  approximately  4 Kg  for  a total  installed  weight  of  under 
27.7  Kq.  Module  orientations  are  rotated  by  90  degrees  within 
the  mount  chassis.  This  allows  all  four  plug-in  inertial  navi- 
gation modules  to  be  identical  yet  achieve  the  desired  gyro  and 
accelerometer  axis  orientations.  After  an  inertial  navigation 
module  is  inserted  into  a slot,  a lever  on  the  actuator  assembly 
is  pushed  forward,  causing  the  instrument  block  to  be  pressed 
onto  a common  alignment  block  in  the  rear  of  the  mount. 

The  unit  cam-lock  handles  are  of  a type  used  on  commercial 
avionics.  The  bottom  of  the  handle  engages  a hook  on  the  mount 
(figure  2-12),  and  when  the  lever  in  the  handle  is  pushed  in, 
the  chassis  mates  with  the  connector  and  the  unit  is  locked  in 
place. 

Figure  2-13  shows  some  details  of  the  actuator  assembly  and  the 
alignment  block. 

Environmental/Aircraft  Characteristics 

General  environmental  and  aircraft  specifications  are  derived 
from  the  present  commercial  inertial  specifications,  ARINC  561, 
and  the  LaRC  SOW.  To  make  the  redundant  strapdown  INS  more 
broadly  applicable,  civil  or  general  aviation  performance  limits 
are  assumed  to  apply.  The  required  and  desired  aircraft  opera- 
tional performance  limits  are: 

Civil  or  General 
Aviation 

4 rad/sec 

50  rad/ sec ^ 

±3  g 


Angular  Rates 
Angular  Acceleration 
Linear  Accel  (maneuver) 


VTOL 

4 rad/sec 
50  rad/sec‘ 
±3  g 
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Figure  2-12.  Redundant  Strapdown  INS  Installation 
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VTOL 


Civil  or  General 
Aviation 


Velocity  (max)  154  m/sec 

Altitude  3,048  m 

Aircraft  tilt  (parked)  ±5° 

Range  of  operation  ±70° 

(Lat) 

Normal  ambient 
temperature: 

Maximum  continuous 
operation: 

Short-term  (30  min) 
over temp: 

Low  operating  temp: 

Vibration  (flight) 


1029  m/sec  (ARINC  561) 
18,288  m (ARINC  561) 
±5° 

Worldwide 

30 °C  (ARINC  561) 

50  °C 
71  °C 
-15°C 

0.762  mm  10-55  Hz 
5 g 55-500  Hz 


It  is  assumed  that  ARINC  404  cooling  air  will  be  available  with 
a flow  of  13.6  kg/hour/100  watts  of  dissipation,  but  that  the 
ARINC  404  form  factor  and  cooling  air  attachment  methods  are  not 
applicable.  ARINC  600  will  require  review  when  available. 

Reliability 

The  reliability  of  a single  channel  of  the  redundant  strapdown 
INS  has  been  calculated  to  be  4100  hours  MTBF.  This  calculation 
is  based  on  MIL-HDBK-217B  failure  rates,  an  "Airborne  Inhabited" 
application  with  part  ambient  temperatures  stabilized  at  a 
maximum  of  70°C.  The 'detailed  failure  rate  breakdown  is  given 
in  Appendix  G. 

This  reliability  may  be  expected  for  a production  system  in  com- 
mercial airline  use  at  some  time  after  introduction  into  service. 
Reliability  is  expected  to  grow  with  time  from  some  initial 
value  as  marginal  components  and  circuits  are  weeded  out  of  the 
system.  An  example  of  this  reliability  growth  is  shown  in 
figure  2-14  for  a first  generation  gimballed  commercial  inertial 
system.  Approximately  three  years  is  needed  to  achieve  mature 
reliability.  One  channel  of  the  redundant  strapdown  involves 
considerably  less  equipment  than  a present  ARINC  system  (no 
gimbals,  one  less  gyro,  one  less  accelerometer,  smaller  power 
supplies,  more  modern  computer,  considerably  less  I/O)  so  4000 
hours  MTBF  appears  a reasonable  prediction  for  mature  channel 
reliability . 
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The  system  failure  probabilities  are  given  in  figure  2-15  for  a 
channel  MTBF  of  2000  or  4000  hours,  flight  durations  of  0.5,  1 
and  8 hours.  In  addition,  reliability  is  also  a function  of  the 
allowable  errors,  improving  significantly  for  outputs  to  the 
flight  control  system  where  it  is  needed  for  flight  safety.  In- 
strument noise,  probability  of  two  simultaneous  failures,  and 
information  limitations  of  the  4 and  3 TDF  gyro  array  were  con- 
sidered in  these  calculations. 

Note  that  for  flight  durations  of  8 hours,  reliability  is  signif- 
icantly degraded.  Reliability  can  be  improved  for  these  long 
missions,  particularly  for  flight  control  outputs,  with  a more 
flexible  I/O  structure  between  instruments  and  computers  so  any 
computer  can  read  any  instrument  without  other  computers  working. 
Probability  of  flight  control  reference  failure  is  reduced  by  a 
factor  of  40.  For  the  short  flight-time  VTOL  application,  the 
lower-flexibility,  lower-cost  configuration  is  adequate. 

Maintainability 

Particular  attention  was  focused  on  airline  maintainability 
considerations  during  the  preliminary  system  design.  For  example, 
the  total  cost  of  spares  needed  by  the  airlines  to  support  the 
equipment  during  operational  use  is  considerably  reduced  by 
having  the  system  consist  of  four  identical  modules. 

Since  the  redundant  strapdown  INS  is  designed  to  provide  signals 
to  the  flight  control  system,  it  must  be  considered  a dispatch 
critical  item.  This  means  that  if  any  of  the  four  channels 
indicates  a failure,  the  aircraft  will  not  take  off.  Thus, 
removal  and  replacement  time  must  be  minimized  in  order  to  limit 
dispatch  delays  - a costly  action  for  airlines,  particularly  in 
short-haul  applications. 

The  packaging  design  of  the  redundant  strapdown  INS  was  especially 
directed  toward  rapid  removal  and  replacement  of  a module  in  the 
aircraft.  Very  simple  latching  mechanisms  are  used  to  engage 
the  connector,  lock  the  unit  in  place,  and  lock  the  inertial 
instruments  into  precise  alignment  with  each  other.  Furthermore, 
this  maintenance  action  can  be  performed  without  removing  power 
to  the  remaining  3 channels  so  therefore  the  ground  gyrocompas- 
sing  mode  need  not  be  reinitiated,  further  shortening  dispatch 
delay.  Once  redundancy  management  equations  are  satisfied,  the 
complete  fail-op/fail-op  system  is  ready  for  takeoff. 
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III.  SPECIFICATION  OF  SYSTEM  REQUIREMENTS 

The  detailed  INU  design  requirements  are  based  first  upon  the 
LaRC  Statement  of  Work  [1].  Esqjansions  upon  these  requirements 
are  also  provided  in  the  Litton  proposal  to  LaRC  [2]  and  the 
preliminary  study  for  NASA,  CR-132419  [3]  . The  means  utilized 
to  fill  in  the  remainder  of  design  requirements  is  to  use  the 
commercial  INS  specifications,  ARINC  561  and  571  [4]  and  [5]  as 
guides.  Additional  material  is  utilized  where  appropriate  with 
the  source  identified. 

ARINC  561  formed  the  basis  for  introduction  of  inertial  systems 
into  commercial  airlines.  It  was  prepared  by  a committee  com- 
posed of  both  INS  manufacturers  and  airlines  and  thus  represents 
environmental,  installation,  and  design  standards  accepted  by 
the  majority  of  the  commercial  avionics  community.  It  also 
references  the  other  applicable  general  specifications  accepted 
by  the  airlines  such  as  for  packaging  and  environmental  testing. 
Some  ARINC  561  requirements  are  not  applicable  to  redundant 
strapdown  INS,  and  these  will  be  analyzed  as  required.  The 
input/output  and  display  requirements  of  the  strapdown  INS  will 
not  be  included  in  this  report  except  in  a very  general  manner. 

3.1  Cost  Factors 

The  system  cost  goal  of  the  redundant  strapdown  navigator  shall 
be  under  $50,000  for  initial  production  quantities  of  approxi- 
mately 200  units.  The  cost  data  are  to  be  presented  in  the  form 
of  CR-132419  [3],  tables  4 and  5,  per  the  LaRC  SOW.  Amortized 
design,  development  and  test  equipment  costs  shall  be  included 
so  that  unit  cost  to  an  airline  is  developed.  Cost  of  warranty 
and  training  shall  not  be  included  at  this  time. 

This  system  cost  goal  is  a considerable  challenge  judging  from 
present  generation,  non-redundant  INS  costs  of  $80K  - $100K  per  unit, 
and  the  conclusion  from  CR-132419  (page  278)  that  a best-case 
10-6  reliability  system  would  cost  about  $78K  (excluding  develop- 
ment and  test  equipment) . The  CR-132419  report  concluded  that 
only  an  "advanced  strapdown  configuration"  requiring  significant 
technology  advances  could  meet  the  goal.  Further,  fail-op/fail- 
op  capability  adds  considerably  to  the  amount  of  redundant 
hardware  needed.  In  fact,  the  system  reliability  requirement  is 
effectively  increased  from  a 10-6  failure  probability  to  almost 
a 10-9  failure  probability  for  a 30-minute  flight.  Best-case 
INS  cost  for  this  reliability  is  projected  to  be  about  $90K  in 
the  CR-132419  report,  excluding  development,  test  equipment  and 
tooling. 

The  redundant  strapdown  INS  is  considered  to  consist  of  the 
following  elements,  as  a minimum: 


35 


403314 


• Four  two-degree-of-f reedom  tuned  gimbal  gyroscopes. 

• Eight  single  axis  accelerometers. 

• Capture  electronics  for  each  of  the  above. 

• Temperature  sensor/control  electronics  for  the  above, 
as  needed  to  meet  system  accuracy  requirements. 

• Redundant  computers  to  process  data  from  the  instru- 
ments to  produce  required  system  outputs.  For  the 
purpose  of  preliminary  design,  four  computers  will 
be  assumed. 

• Redundant  instrument-to-computer  input/output 
provisions . 

• Redundant  computer-to-computer  interface  provisions. 

• Representative  system  digital  input/output  channels 
to  tie  the  redundant  strapdown  INS  to  d isplays  and 
other  aircraft  avionics. 

• Redundant  power  supplies,  clocks,  etc.  required  for 
system  operation. 

The  design  of  the  redundant  computers  with  associated  I/O  will 
be  based  on  representative  hardware  expected  to  be  available  for 
production  go-ahead  in  the  late  1970's.  Digital  subsystem 
designs  will  only  be  detailed  to  the  extent  needed  for  costing 
and  reliability  estimating  and  will  not  necessarily  reflect  the 
optimum  redundancy  management  approach. 

To  achieve  a clearer  understanding  of  cost  vs.  system  design 
parameters,  trade-off  analyses  are  required  in  the  following 
categories : 

a.  Derive  cost  as  a function  of  packaging  philosophy.  The 
optimum  packaging  to  be  employed  for  all  the  various 
elements  of  the  redundant  strapdown  INS  is  a function 
of  not  only  unit  cost,  but  also  airline  maintenance 
methods  and  aircraft  dispatch  constraints.  A broad 
analysis,  including  airborne-incurred  cost  factors 
such  as  spares  costs  and  dispatch-delay  costs  is 
required . 

b.  Determine  optimum  power  supply  (including  clocks, 
reference  voltages,  etc.)  configuration  (three  with 
switching  as  described  in  the  Litton  proposal  [2]  vs 
four  unswitched). 

c.  Determine  the  lowest-cost  redundancy  mechanization 
which  will  meet  the  fail-op/fail-op  and  system 
reliability  requirements. 
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A common  means  of  reducing  the  cost  of  an  item  is  to  increase  the 
production  base  through  sales  to  a variety  of  customers.  The 
ARINC  561  INS  is  a good  example.  A standardized  design  allowed 
application  of  the  system  to  a variety  of  customers,  commercial 
and  private.  This  increased  the  production  base  and  maintained 
a relatively  low  price  for  an  item  of  rather  sophisticated 
avionics.  Therefore,  the  redundant  strapdown  INS  should  not  be 
tailored  precisely  to  expected  VTOL  needs  unless  the  cost 
benefits  are  clear. 

Present  generation  INS  have  a material/labor  split  of  approxi- 
mately  60%/40%,  respectively.  Labor  costs  normally  follow  a 
learning  curve  such  as  the  Northrop  87  curve,  and  would  reduce 
by  approximately  13%  if  the  system  quantity  is  doubled  (200  to 
400  systems).  Material  costs  savings  only  benefit  if  large 
single  buys  can  be  made.  Assuming  labor  cost  savings  only,  a 
system  costing  $50K  at  quantity  200  will  cost  $47K  for  400. 
Therefore,  some  cost  penalties  may  be  allowed  in  the  interest  of 
standardization  for  an  increased  production  base.  One  example  of 
this  concept  is  to  include  a small  amount  of  extra  computer 
memory  for  wider  aircraft  altitude,  speed,  and  latitude  capa- 
bility rather  than  limiting  performance  to  the  VTOL  envelope. 

3 . 2 Reliability 


The  redundant  strapdown  INS  shall  be  a fail-op/fail-op  design, 
such  that  any  two  failures  of  any  component  or  subsystem  can  be 
detected,  isolated  and  disconnected  without  compromising  system 
performance  as  specified  in  Paragraph  3.3  of  this  report. 

The  probability  that  more  than  two  failures  occur  or  are  detected 
and  disconnected  (even  if  they  did  not  occur),  shall  be  less  than 
10-6  for  a 30-minute  flight.  It  is  assumed  that  take-off  will 
not  proceed  if  one  or  more  failures  have  been  detected  prior  to 
flight . 

Failures  are  classified  as  either  hard  or  soft  failures.  A hard 
failure  is  defined  as  a condition  where  a subsystem  (gyro, 
accelerometer,  computer,  power  supply)  becomes  totally  incapable 
of  performing  its  intended  function  due  to  a component  failure 
or  out-of-tolerance  failure  mode.  A soft  failure  is  defined  as 
a condition  where  a subsystem  looses  a portion  of  its  intended 
function  due  to  a component  failure  or  out-of-tolerance  failure 
mode,  resulting  in  degradation  of  system  output  accuracy. 

A "failure"  of  the  redundant  strapdown  INS  is  defined  as  the 
condition  where  the  outputs  required  in  Paragraph  3.4  are  not 
available  due  to  a number  of  hard  failures , or  where  the  accuracy 
of  one  or  more  of  the  system  outputs  has  degraded  to  greater  than 
(TBD)  times  the  required  rms  accuracy. 
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Completely  separate  computer  I/O  channels  to  other  aircraft 
avionics  will  be  assumed  for  each  computer,  with  the  selection 
of  the  proper  channel  performed  by  the  external  equipment,  based 
on  redundant  strapdown  INS  self-test  indications  and  external 
voting  logic.  All  other  redundancy  management  and  switching 
will  be  self-contained.  Any  switching  circuitry  included  for 
redundancy  management  is  also  subject  to  the  fail-op/fail-op 
requirement. 

Present  generation  commercial  (e.g.,  Litton  LTN-72)  INS  are 
currently  achieving  an  in-service  MTBF  of  about  2000  hours. 
Therefore  meeting  considerably  better  than  10“^  probability  of 
complete  system  failure  for  the  redundant  strapdown  INS  is 
assured  once  the  fail-op/fail-op  design  is  implemented.  Achiev- 
ing high  total  part-count  MTBF  if  also  highly  desirable,  however, 
in  order  to  reduce  maintenance  costs  and  minimize  dispatch  de- 
lays. A sound,  system  thermal  design  is  essential  to  meet  this 
goal.  As  stated  in  ARINC  561,  "....the  rule  of  thumb  on  elec- 
trical component  failures  indicates  a four-fold  increase  in 
failure  rates  when  the  normal  operating  component  temperature  is 
increased  30  to  50 °C."  While  calculations  performed  at  Litton 
using  RADC  Reliability  Notebook  failure  rates  indicate  degrada- 
tion of  only  about  20-30%  for  a typical  modern  inertial  system 
under  these  thermal  conditions,  adequate  cooling  provisions  are 
still  essential  to  good  system  design. 

Aircraft  and  personnel  safety  are  of  primary  concern  in  the  de- 
sign of  the  failure  detection  and  disconnection  mechanizations. 

Redundancy  management  switching  due  to  soft  failures  shall  not 
cause  transients  or  steps  in  the  output  signals.  Reconfigured 
outputs  shall  transition  from  the  previous  to  the  new  value  with 
a time  constant  long  enough  to  not  cause  passenger  discomfort. 
System  elements  removed  from  output  calculations  shall  still  be 
monitored  for  both  hard  and  soft  failure  criteria.  In  the  event 
of  more  than  two  component  failures,  the  soft-failure  component 
may  be  restored  to  operation  if  still  available,  if  aircraft 
safety  is  thereby  improved.  Once  a component  is  rejected  for  a 
hard  failure  it  shall  not  be  used  for  the  remainder  of  the 
flight. 

The  concept  of  redundancy  also  includes  the  external  effects  on 
proper  INS  operation.  Thus,  separate  aircraft  power  circuits 
must  be  available  for  the  redundant  INS  power  supplies.  This 
concept  could  be  carried  further  to  the  cooling  system.  How- 
ever, since  the  INS  can  probably  be  designed  to  operate  for 
30  minutes  without  cooling  air,  redundant  cooling  is  not  required 
Triple  redundant  INS  are  presently  installed  side-by-side  in  the 
Boeing  747,  cooled  by  the  same  down-draft  blower.  While  it  is 
also  desirable  that  redundant  elements  be  located  in  different 
parts  of  the  aircraft  so  they  are  not  subject  to  the  same 
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catastrophic  event  (e.g.,  lightning  strike,  explosion,  etc.)  it 
appears  impractical  to  do  so  with  strapdown  system  components. 
Substantial  accuracy  degradation  occurs  with  aircraft  flexure. 
Aircraft  designers  must  locate  the  strapdown  redundant  INS  away 
from  rotating  machinery  such  as  engines  or  APU's  which  could 
shed  debris  during  failure  modes  and  thus  simultaneously  cause 
complete  redundant  strapdown  INS  failure. 

Chain  type  failures  must  also  be  avoided  within  the  INS,  partly 
to  reduce  maintenance  costs  but  primarily  to  avoid  excessive 
heat  or  tripping  of  breakers  which  could  lead  to  loss  of  other 
redundant  functions.  The  need  for  partial  power  supply  shut- 
down, short-circuit  and  overvoltage  protection  should  be 
considered  for  this  purpose. 


3.3  Accuracy 

The  redundant  strapdown  INS  shall  have  the  following  output 
accuracy : 


Attitude  rate 


0.05°/sec,  rms,  per  axis 


Attitude 
Heading 
Position  rate 


Acceleration 


0.1°,  rms , per  axis 
0.2°,  rms 

1.03  m/sec  (95)  radial  with  external 
updates  every  5 seconds,  update  noise 
of  122m  rms,  zero  correlation  time, 
61m  rms,  20  second  correlation  time, 
per  axis 

0.003  m/sec^ 


This  accuracy  shall  apply  with  either  0,  1 or  2 hardware  failures, 
through  the  operational  environment  described  in  paragraph  3.7 
of  this  report  and  with  an  external  update  outage  of  60  seconds. 

It  is  assumed  that  aircraft  installation  errors  are  not  included, 
aircraft  parking  coordinates  have  been  entered  perfectly  and  a 
full  gyrocompass ing  alignment  (paragraph  3.5)  has  been  completed 
at  a latitude  of  45°  prior  to  first  aircraft  motion. 

3.4  System  Input/Output 

Output  requirements  are  as  listed  in  the  following  table. 
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This  list  contains  the  minimum  of  items  typically  provided  by  an 
aircraft  INS.  It  does  not  include  special  functions  such  as  way- 
point  steering  which  are  assumed  to  be  performed  by  a central 
computer  complex  and  display.  For  the  purposes  of  size,  weight, 
reliability  and  cost  estimates,  one  ARINC  575  serial  output 
channel  shall  be  provided  for  each  of  the  redundant  INS  computers. 
The  capacity  of  this  type  of  I/O  is  439  24— bit  words/sec  vs  300 
words/sec  for  the  above  list,  not  including  the  display.  The 
parts  count  for  implementation  is  considered  representative  of 
moderate  performance,  serial  digital  I/O  techniques. 

A separate  output  line  indicating  failure  of  one  or  more  system 
components/subsystems  shall  be  provided  from  each  redundant  com- 
puter . 

Input  requirements  consist  of  altitude  from  an  air-data  system 
and  filter  updates  based  on  VOR/DME  or  OMEGA  data.  Baseline 
update  quantities  are  2 velocities  and  2 position,  (4  total),  at 
a maximum  rate  of  one  full  update  every  5 seconds.  Additional 
inputs,  TBD,  will  be  received  from  a display.  The  present  ARINC 
575  digital  I/O  format  cannot  drive  a receiver  from  more  than  one 
transmitter.  For  the  purposes  of  size,  weight,  reliability  and 
cost  estimates,  therefore,  three  ARINC  575  serial  digital  input 
channels  shall  be  provided  for  each  of  the  redundant  INS  com- 
puters. Additional  channels  may  be  needed  for  inter-computer 
data  transfer  (not  necessarily  to  ARINC  format). 

3.5  Reaction  Time 

The  redundant  strapdown  INS  shall  complete  its  self-contained 
alignment  in  less  than  10  minutes  from  system  turn-on.  No 
external  inputs  shall  be  required,  with  the  exception  of  air- 
craft latitude  and  longitude  entered  within  two  minutes  after 
system  turn-on.  Aircraft  motion  during  alignment  shall  consist 
of  the  model  described  in  Paragraph  3. 7. 4.1  of  this  report.  The 
alignment  time  required  applies  for  a starting  ambient  tempera- 
ture greater  than  0°C  (ARINC  561)  and  less  than  50 °C  and  for  a 
latitude  less  than  70°. 

3.6  Modes  of  Operation 

OFF  All  power  is  removed  from  the  system. 

ALIGN  Automatic  sequencing  through  the  various  steps 

needed  for  alignment  shall  be  provided.  The  align 
mode  is  initiated  only  on  the  ground.  Automatic 
transfer  to  the  navigate  mode  shall  occur  if 
aircraft  motion  is  detected  via  the  INS  acceler- 
ometers . 
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NAV  All  outputs  shall  be  provided  to  full  accuracy  in 

this  mode. 

UPDATE  External  inputs  to  the  INS  shall  be  accepted  while 
in  the  NAV  mode  to  correct  INS  position  and 
velocity. 

ATTITUDE  Consideration  shall  be  given  to  use  of  a pendulous 
attitude  mode  in  flight  during  certain  failure 
conditions  if  the  end  reliability  of  attitude  and 
attitude  rate  outputs  can  be  improved. 

3.7  Environment 

The  redundant  strapdown  INS  shall  be  designed  in  accordance  with 
ARINC  414  [6]  except  as  modified  herein,  and  be  capable  of  being 
tested  in  accordance  with  RTCA  Paper  120-61/DO-108,  [7],  with 

conditions  modified  to  be  consistent  with  this  specification. 


3.7.1  Flight  Profile  Operating  Conditions 


A typical  flight  profile  for  the  VTOL  application  consists  of: 


a.  System  turn-on  at  20 °C,  start  alignment,  passenger 
loading/refueling  in  progress,  aircraft  subject  to 
wind  gusts,  ground  power  applied  to  the  aircraft. 

b.  Engine  turn-on  after  5 minutes. 

c.  System  advanced  to  Navigate  Mode  after  10  minutes, 
remove  ground  power. 

d.  Engage  rotors,  perform  vertical  take-off. 

e.  Climb  to  300  m altitude,  turn  left  90°  at  a turn 
rate  of  3°/sec. 

f.  Accelerate  to  103  m/sec  and  cruise  for  6 minutes. 

g.  Turn  left  90°  then  spiral  down  at  turn  rates  of  3°/sec. 
(typical  peak  turn  rate  of  30°/sec  is  indicated  in 

the  data  of  the  reference  [101  CH-46  flight  testing). 

h.  Decelerate  and  perform  vertical  descent  to  touchdown. 

i.  Disengage  rotors,  unload/reload  passengers  for  3.5 
minutes . 

j.  Repeat  d.  thru  h.  two  additional  times,  then  turn  off 
system  power. 


The  non-VTOL  applications  are  assumed  to  have  the  flight  profile 
as  follows: 
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a.  through  c.  - Same  as  above 

d.  Take-off,  climb  to  9,000  m altitude,  accelerate  to 
257  m/sec, 

e.  Turn  left  90°  at  a turn  rate  of  3°/sec., 

f.  Cruise  for  2 hours  with  two  10°  course  changes  at 
turn  rates  of  l°/sec. 

The  required  and  desired  aircraft  operational  performance  limits 
are: 


VTOL 

CIVIL  OR  GENERAL 
AVIATION 

Angular  Rates 

4 rad/sec 

4 rad/sec 

Angular  Acceleration 

50  rad/sec 

2 

50  rad/sec2 

Linear  Accel . (maneuver ) 

±3  g 

±3  g 

Velocity  (max. ) 

154  m/sec 

1029  m/sec  (ARINC  561) 

Altitude 

3,048  m 

18,  288  m (ARINC  561) 

Aircraft  tilt  (parked) 

±5° 

±5° 

Range  of  operation 
( latitude ) 

±70° 

Worldwide 

7.2  Ambient  Temperature 

(Per  ARINC 

561) 

Normal  ambient  temperature: 

30  °C 

Maximum  continuous  operation: 

50°C 

Short  term  (30  min.)  overtemp: 

71  °C 

Low  operating  temp: 

-15  °C 

Note:  The  ARINC  Airlines  Electronics  Engineering  Com- 

mittee is  currently  reviewing  all  avionics  in- 
stallation methods  for  next-generation  aircraft. 
Revised  packaging  and  cooling  methods  contained 
in  ARINC  600,  not  released  at  this  time,  require 
further  review. 

3.7.3  Cooling  Air 

It  is  highly  desirable  that  the  redundant  strapdown  INS  operate 
without  requiring  the  use  of  cooling  air  since  ARINC  404  cooling 
(impingement)  produces  internal  contamination.  This  could  be 
accomplished  if  the  aircraft  installation  design  limits  the 
maximum  continuous  ambient  temperature  to  30°C.  In  order  to 
provide  installation  flexibility,  however,  ARINC  404  [8]  cooling 
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provisions  should  also  Toe  included,  with  a cooling  air  flow  of 
13.6  Kg/hour/100  watts  of  dissipation.  The  use  of  heat  ex- 
changers having  small  openings  shall  be  avoided  due  to  the  high 
likelihood  of  closure  with  dust.  If  the  installation  requires 
extended  operation  at  50 °C  ambient  conditions,  the  cooling  air 
will  be  utilized  to  achieve  highest  reliability. 

3.7.4  Vibration 


3. 7. 4.1  Ground 

Movement  of  the  aircraft  while  parked  may  occur  due  to  wind  gusts 
impinging  on  the  fuselage,  loading  and  unloading  of  passengers, 
refueling  activities,  and  engine  vibrations.  The  statistical 
properties  of  wind  are  described  in  NACA  Report  1272.  When  this 
power  spectrum  is  applied  to  a typical  parked  aircraft  transfer 
function,  the  resulting  horizontal  motion  may  be  modeled  as  a 
first  order  Markov  process  with  a standard  deviation  of  4mm  and 
a correlation  time  of  20  seconds.  This  model  will  need  to  be 
reviewed  once  the  VTOL  weight,  form  factor  and  INS  location  in 
the  aircraft  are  established.  The  above  model  is  felt  to  be 
conservat ive . 

Data  are  available [9]  on  aircraft  motion  while  parked  for  a 
number  of  aircraft,  including  the  British  Canberra,  Comet,  and 
the  Boeing  707  . These  data  were  not  reduced  into  a statistical 
model,  but  horizontal  motion  of  the  Canberra  (which  is  approxi- 
mately 21m  in  length  and  weighs  13,600  Kg  vs  13m  and  9,000  Kg 
for  the  CH-46 ) was  under  3mm  peak-to-peak  during  wind  gusts  of 
up  to  12  m/sec  and  from  varying  directions. 

Another  effect  described  in  [9]  is  excitation  of  the  aircraft 
undercarriage  resonance,  approximately  1 cps  for  these  aircraft, 
by  wind,  refueling  and  passenger  movement.  Motions  of  2.5  arc 
minutes,  peak-to-peak  in  roll  and  3.8  arc  minutes  in  yaw  were 
recorded . 

Data  on  motion  of  a CH-46  were  taken  110]  to  determine  errors  of 
a strapdown  navigator  in  the  helicopter  vibration  environment. 
Unfortunately,  the  main  data  reduction  of  the  report  was  limited 
to  flight  data  (discussed  in  the  next  section  of  this  report) . 

A review  of  partially  reduced  ground  data  from  [10]  indicates  an 
apparent  CR-46  undercarriage  resonance  at  approximately  4.5  cps, 
and  angular  motion  of  roughly  0.4  arc  minutes  peak-to-peak. 

For  the  purposes  of  this  report,  pure  coning  motions  of  4 arc 
minutes  (cone  whole-angle)  at  1 cps  and  one  arc  minute  at  4.5 
cps  shall  be  assumed. 

Passenger  loading  also  causes  variable  compression  of  the  air- 
craft undercarriage.  Vertical  motions  of  up  to  0.1  m have  been 
recorded  [9]  . This  could  result  in  pitch  or  roll  rotations  of 
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up  to  0.5°,  depending  on  the  dimensions  of  the  aircraft  and  the 
location  of  oleo  struts.  Also,  this  motion  is  sudden  as  the 
static  friction  of  the  oleo  struts  is  overcome.  Sudden  changes 
of  yaw  up  to  2.5  arc  minutes  were  also  observed. 

In  the  flight  profile  of  Paragraph  3.7.1  of  this  report,  it  was 
assumed  that  the  INS  would  be  transferred  to  the  navigate  mode 
before  rotors  are  engaged.  While  this  may  generally  be  the 
case,  it  is  possible  that  the  reverse  will  occur.  Comparison 
of  the  partially  reduced  CH— 46  ground  data  from  [10]  (rotors  on) 
with  flight  data  shows  PSD  vibration  peaks  to  be  factors  of  4 to 
100  less  than  those  occurring  during  flight.  Therefore,  it  will 
be  assumed  that  1/4  of  the  in-flight  coning  and  sculling  vibra- 
tion power  levels  are  also  occurring  on  the  ground  during  align- 
ment . 

3.7.4. 2 Flight 

The  redundant  strapdown  INS  shall  operate  with  specified  accuracy 
during  vibration  as  specified  by  RTCA  Paper  120— 61/DO— 108, 
Category  A.  This  vibration  level  consists  of  a constant  total 
excursion  of  0.762  mm  from  10  to  55  cps  with  a maximum  of  5 g, 
and  of  5 g from  55  to  500  cps. 

3. 7.4. 3 Coning  and  Sculling  Motions 

The  power  spectral  density  and  Co  and  Quad  spectral  density  plots 
for  the  CH-46C,  as  derived  from  flight  test  [10],  can  be  repre- 
sented by  the  approximate  environment  shown  below: 


SINUSOIDAL 

Linear  0 . 3 a 28  HZ 


Angular  1.0  DEG/SEC^^^  a 15  HZ 


RANDOM 

0.00045  (g^^/HZ 
0-200  HZ  (O.Sgp^g) 

0.033  ( DEG/SECj^ )2/HZ 
0-30  HZ  (1.0  DEG/SECj^) 


Lineai/Angular  0 . 1 gjy^jg-DEQ/SECjy^  al5  HZ 


0.0033  (g^DEG/SEC^) 


0—30  HZ  (0.1 
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Further  analysis  of  these  data  is  presented  in  [11].  These  data 
may  be  used  to  determine  redundant  strapdown  INS  errors  due  to 
aircraft  coning  and  sculling.  (Coning  is  an  angular  motion  of  a 
body  described  by  sinusoidal  velocities  about  one  body  fixed 
axis  and  one  space-fixed  axis  which  will  cause  a third  axis  to 
prescribe  a pure  cone  in  inertial  space.  The  two  oscillatory 
rates  are  in  quadrature  to  produce  the  conical  motion  of  the 
third.  ) 

(Sculling  motion  is  made  up  of  a combination  of  a linear  vibra- 
tion along  one  axis  and  an  angular  oscillation  around  a perpen- 
dicular axis  - both  at  the  same  frequency.) 

These  data  are  taken  from  a vibration  measurement  system  flown 
in  a CH-46C  helicopter  at  Langley  Research  Center  in  August  1969. 
The  motions  of  the  vehicle  were  recorded  for  various  conditions, 
both  on  the  ground  and  in  flight.  A one-minute  portion  of  the 
recorded  motions  during  level  flight  with  the  start  of  a deceler- 
ation was  used  to  generate  power  and  cross  spectral  densities. 
Analog  spectral  analysis  equipment  was  used  to  generate  the  in- 
phase  and  quadrature  portions  of  the  spectra.  The  resulting 
spectra  indicate  that  most  of  the  environment  is  near  dc,  due  to 
the  normal  maneuvering  of  the  vehicle  and  near  15  Hz  and  27  Hz 
which  is  coming  from  the  rotors.  There  is  some  energy  near  400 
Hz  which  would  come  from  the  helicopter  turbine  engines. 

3.7.5  Shock 

Operational:  6 g with  a time  duration  of  at  least  10  milli- 

seconds , in  accordance  with  the  procedure  of 
RTCA  Paper  120-61/00-108. 

Crash  Safety:  15  g with  a time  duration  of  at  least  10 

milliseconds,  in  each  direction. 

3.8  Power 

The  aircraft  power  supply  characteristics,  utilization  and 
general  guidance,  are  given  in  ARINC  413.  The  redundant  strap- 
down  INS  shall  be  designed  to  use  115V  AC  single  phase  power, 
per  MIL-STD-704,  Category  B.  A separate  input  shall  be  utilized 
for  each  redundant  power  supply. 

Capability  of  operation  from  an  external  battery,  equivalent  to 
Sonotone  P/N  CA-51N,  shall  be  provided  with  each  redundant  power 
supply.  In  addition,  each  supply  shall  contain  a battery  charger, 
as  required  by  ARINC  561.  Due  to  the  dependence  of  the  INS  upon 
the  battery  during  power  interruptions  such  as  transfer  from 
ground  to  aircraft  power,  the  INS  suppliers  have  traditionally 
insisted  upon  retaining  the  responsibility  for  maintaining  the 
battery  in  a charged  state.  The  redundant  strapdown  INS  shall 
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also  have  the  capability  of  operating  from  redundant  standby 
computer  DC  buses  for  backup  power,  as  defined  in  ARINC  571, 
paragraph  2. 4. 5.1,  in  lieu  of  the  battery. 

3.9  Memory  Non- Volatility 

The  computer  program  memory  shall  not  be  altered  by  short  or  long 
primary  power  interruptions.  In  addition,  permanent  gyro/ 
accelerometer  constants  such  as  scale  factors  and  non- 
orthogonalities, shall  be  stored  in  a non-volatile  memory.  Also, 
the  last  computed  values  of  following  variables  shall  be  retained 
after  system  power  shut-down  for  use  during  the  next  alignment: 

a.  Gyro  compensation  constants 

b.  Accelerometer  compensation  constants 

c.  Other  modifiable  calibration  constants 

d.  Latitude  and  longitude 

e.  Maintenance  related  data,  e.g.,  self-test  results 

3.10  Packaging  Philosophy 

While  redundant  navigation/autopilot  equipment  currently  in  use 
by  airlines  consists  of  separate,  non-redundant  boxes,  no  FAA 
directive  has  been  found  giving  this  approach  as  a firm  require- 
ment. The  overriding  concern  of  systems  using  redundant  elements 
is  that  a failure  in  one  element  not  cause  a failure  of  another. 
Separate  packaging  of  each  element  is  helpful  in  achieving  this 
requirement.  Electrical  interactions  are  more  common  problems, 
however,  and  avoidance  of  these  is  more  a function  of  good  design 
practice  rather  than  the  physical  arrangement. 

Low  system  cost  in  service  is  a major  design  constraint.  Packag- 
ing all  components  into  a single  unit  reduces  the  number  of 
connectors,  chassis  cost,  wire  harness  cost  and  special  components 
to  drive/receive  signals  through  cables.  A more  modular  concept, 
on  the  other  hand,  reduces  the  total  number  of  spares  required 
(each  VTOL-port  needs  spares  since  takeoff  cannot  occur  with 
failures  in  any  redundant  element),  and  conceivably  could  reduce 
dispatch  time  if  the  total  system  can  be  left  running  during 
replacement  of  the  failed  element.  The  selection  of  the  packag- 
ing concept  will  be  made  after  a cost  tradeoff,  as  discussed  in 
paragraph  3.1  of  this  report.  To  assure  non- interactive  failures, 
the  following  design  constraints  shall  apply: 

a.  Redundant  elements  shall  not  be  packaged  into  the 
same  card  or  plug-in  module. 
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b.  Separate  ground  buses  shall  be  used  to  prevent  high 
failure  currents  from  interfering  with  other  elements. 

c.  Redundant  signals  may  share  the  same  external  connector 
but  pins  must  be  sufficiently  separated  that  a bent 
pin  will  not  interfere  with  another  element. 

d.  A high  current  drain  due  to  a failure  shall  not  cause 
a power  supply  failure  if  that  supply  is  used  by 
another  element . 

e.  Consideration  should  be  given  to  electromagnetic 
isolation  and/or  power  shutdown  where  high  RFI 
conditions  may  result  from  a failure. 

f.  The  module  designs  shall  be  such  that  they  may  be 
packaged  into  a non- redundant  strapdown  INS  unit  if 
desired  for  other  applications. 

3.11  Form-Factor/Weight 

The  Airlines  Electronic  Engineering  Committee  (AEEC)  of  ARINC  is 
currently  reviewing  packaging  and  installation  requirements  for 
future  avionics.  Revised  packaging,  form-factor,  cooling,  etc., 
requirements  may  result  from  this  review.  In  the  meantime, 
however,  as  a goal  ARINC  404  [8]  packaging  methods  are  assumed 
to  apply.  Deviations  to  this  requirement  shall  be  supported  by 
cost  trade-off  data.  For  ease  of  handling,  the  weight  of  any 
unit  replaceable  on  the  aircraft  shall  be  less  than  20.4  kg 
(this  is  the  approximate  weight  of  present-generation  ARINC  571 
[5] ISS) . 

3.12  Installation  Provisions 

The  redundant  strapdown  INS  shall  use  the  mounting  provisions 
and  handles  similar  to  current  commercial  INS,  per  ARINC  561,  if 
practical.  Units  shall  be  capable  of  installation  into  the 
aircraft  by  personnel  with  minimum  training  and  in  a maximum 
time  duration  of  1 minute. 

The  redundant  strapdown  INS  shall  have  the  capability  of  instal- 
lation with  the  unit  long  dimension  either  along-ship  or  cross- 
ship. It  is  assumed  that  computer  software  (or  firmware) 
modifications  are  needed  to  change  installation  orientation. 

The  redundant  strapdown  INS  unit  will  be  installed  in  the  air- 
craft with  an  installation  tolerance  of  ±6  arc  minutes  in  pitch 
and  roll  and  ±12  arc  minutes  in  azimuth  (per  ARINC  561  for  SST 
aircraft)  as  a goal,  with  ±12  arc  minutes  in  all  axes  as  a firm 
requirement.  The  system  accuracy  requirement  of  paragraph  3.3 
of  this  report  does  not  include  the  effects  of  this  misalignment. 
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The  INS  base  (mount),  if  needed,  is  considered  part  of  the 
redundant  strapdown  INS. 


3.13  Maintenance  Philosophy 

The  maintenance  philosophy  generally  desired  by  commercial  air- 
lines is  to  do  all  of  their  own  repairs,  down  to  the  piece-part 
level.  This  is  partly  to  protect  themselves  against  vendor 
problems  such  as  strikes,  bankruptcy,  etc..  In  the  case  of  INS, 
however  this  policy  is  modified  since  test  equipment  and  training 
costs  are  high.  Large  airlines  or  airline  pools  do  most  of  their 
own  repairs,  with  the  exception  of  gyros  and  accelerometers. 

Some  airlines  only  do  module  replacement,  smaller  users  send  the 
entire  unit  back  to  the  manufacturer  under  a maintenance  contract 
(a  fixed  cost/unit/operating  hour). 

The  maintenance  levels  have  been  characterized  by  Litton  as 
follows : 


Level  1 . 
Level  2 . 
Level  3 . 

Level  4 . 


Unit  replacement,  in  aircraft 

Module  replacement,  in  the  shop 

Module  repair  (excluding  gyros  and  acceler- 
ometers ) 

Gyro/accelerometer  repair 


Maintenance  levels  3 and  4 will  not  be  considered  further  in  this 
report . 

Level  1 maintenance  is  performed  at  all  airports  serviced  by  the 
airline  for  units  designated  dispatch  items.  Take-off  is  not 
allowed  with  a failure  in  a piece  of  avionics  so  designated  since 
flight  safety  is  involved.  The  redundant  strapdown  INS  falls 
into  this  category  since  it  is  required  by  the  flight  control/ 
stability  augmentation  system.  The  speed  at  which  such  a unit 
replacement  may  be  made  is  very  important  to  airlines  since 
flight  delays  result  in  significant  cost  penalties.  Ability  to 
replace  a portion  of  a redundant  system  without  turning  off 
system  power  or  requiring  a realignment  would  be  a very  desirable 
feature. 


3.14  Maintainability  Design 

Plug-in  assembly  construction  shall  be  used  to  the  greatest 
extent  practical.  All  modules  bearing  the  same  part  number 
shall  be  interchangeable.  As  a goal,  electronic  modules  shall 
not  require  adjustment  or  recalibration  after  replacement.  Care 
should  be  exercised  in  locating  and  mounting  of  modules  and 
components  for  ease  of  accessibility. 
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Each  aircraft- replaceable  unit  shall  have  a failure  indicator, 
visible  from  the  front  panel  which  indicates  that  one  or  more  of 
the  internal  modules  has  failed.  This  indication  shall  be  present 
with  or  without  power  applied  to  the  system  and  shall  only  be 
reset  upon  successful  completion  of  self-test. 

Highly  reliable  self-test  shall  be  included,  consistent  with 
redundancy  management  requirements.  All  self-test  provisions 
shall  be  continuous  and  automatic,  with  no  pilot— initiated  tests. 

Sufficient  unit  test  points  shall  be  included  to  allow  fault 
isolation  to  the  module  level  using  the  test  equipment  defined 
in  paragraph  3.15  of  this  report.  Module  test  points  shall  be 
provided  to  allow  fault  isolation  to  the  failed  component  with- 
out probing. 

3.15  Test/Calibration 

A.  Level  1 Maintenance  - in  aircraft. 

No  test  equipment  shall  be  required  for  operation/calibration  of 
the  redundant  strapdown  INS  while  it  is  installed  in  the  aircraft. 
An  automatic  partial-calibration  of  gyro  drifts  shall  be  per- 
formed during  ground  alignment.  The  redundant  sensor  data 
(during  conditions  of  no  failures)  may  be  used  for  self-calibration 
to  the  extent  practical. 

B.  Level  2 Maintenance  - in  shop. 

Special  purpose  test  equipment  requirements  shall  be  identified 
for  use  during  routine  maintenance.  It  shall  be  capable  of 
performing  strapdown  sensor  calibrations  as  required  for  accu- 
rate system  operation  and  of  entering  these  constants  into  the 
non-volatile  airborne  system  memory.  The  design  of  this  test 
equipment  shall  allow  its  use  for  Level  2 maintenance  by  airline 
personnel . 

C.  Level  3 Maintenance  - not  considered  at  this  time. 

D.  Level  4 Maintenance  - not  considered  at  this  time. 

3.16  Operational  Service  Life 

The  redundant  strapdown  INS  shall  be  capable  of  operation  for  at 
least  3,000  hours,  preferably  5,000  hours,  without  additional 
lubrication,  adjustment  or  replacement  of  components  (per  ARINC 
414).  Scheduled  calibrations  required  to  be  performed  during 
Level  2 maintenance,  shall  be  minimized. 
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3.17  Electromagnetic  Interference 

The  redundant  strapdown  INS  shall  meet  the  conducted  and  radiated 
susceptibility  and  emission  requirements  of  ARINC  413,  and  the 
test  requirements  of  RTCA  Paper  120-61/DO-108 , for  Category  A 
equipment.  Grounding  and  shielding  practices  shall  be  used  in 
accordance  with  ARINC  413.  (NOTE:  Cateqory  A is  for  aircraft 
greater  than  5670  kg,  Category  B is  for  light  aircraft  and 
is  less  stringent). 

3.18  Humidity 

The  redundant  strapdown  INS  shall  be  capable  of  normal  operation 
during  conditions  of  a relative  humidity  varying  from  10%  to 
100%,  combined  with  temperature  and  altitude  cycling  encountered 
in  normal  aircraft  operation,  as  defined  by  ARINC  414,  for 
Category  A (standard)  environment. 

3.19  Explosive  Atmosphere 

Explosive  atmosphere  is  not  normally  encountered  by  electronics 
equipment  in  airline  type  aircraft.  Specific  installations 
where  explosive  vapor  presents  an  operating  hazard  are  normally 
defined  by  the  airframe  manufacturer. 

3 . 20  Atmospheric  Pressure 

Normal  atmospheric  pressure  range  is  from  -305  m to  13,700  m. 
Decompression  from  a pressure  altitude  of  2,133  m to  13,700  m in 
15  seconds  or  less  shall  not  degrade  system  performance*  per 
ARINC  414. 
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IV.  SYSTEM  SYNTHESIS  AND  DESIGN 

The  approach  used  to  reach  the  preliminary  design  concept  in 
this  report  is  to  first  present  general  design  constraints 
(paragraph  4.1),  followed  with  a description  of  hardware  and 
software  needed  to  implement  a non- redundant , strapdown  INS 
(paragraph  4.2).  Redundancy  is  then  introduced  to  the  overall 
system,  to  the  instruments,  and  to  the  complete  system  software 
mechanization.  The  advantages  and  disadvantages  of  various 
alternative  configurations  are  presented,  along  with  the  ration- 
ale for  selection  of  the  final  design. 

System  redundancy  requirements  are  analyzed  in  paragraph  4.3. 
Methods  of  achieving  the  system  reliability  requirement  with  a 
fail-op/fail-op  configuration  are  described.  The  effects  of 
imperfect  failure  detection  and  isolation  are  considered  in 
achieving  the  recommended  system  configuration. 

The  information  content  of  three  and  four  TDF  gyro  systems  is 
analyzed  in  depth  in  paragraph  4.4.  Means  of  estimating  failure 
detection  and  isolation  probability  for  a three  gyro  array  is 
presented.  Discussion  of  instrument  geometry,  parity  equations 
used  for  failure  detection  and  isolation,  processing  of  parity 
equations  in  the  presence  of  system  noise  and  methods  of 
switching  information  following  the  isolation  process  are  also 
covered  in  this  section. 

Software  mechanization  options  are  discussed  in  paragraph  4.5. 

The  selected  mechanization  considers  maintaining  visibility  of 
subtle  errors  throughout  the  processing  to  allow  external 
improvements  in  failure  detection  and  isolation  processing. 
Capability  of  complete  recovery  from  failures  without  retaining 
errors  needed  to  perform  failure  detection  and  isolation  is  also 
provided.  Software  requirements  for  INS  updating  from  radio 
aids,  and  a trade-off  of  software  compensation  of  strapdown 
instrument  errors  are  presented. 

System  packaging  options  are  presented  in  paragraph  4.6.  A cost- 
of -owner ship  trade-off  illustrates  the  large  impact  that  the 
packaging  arrangement  can  have  in  airline  cost.  A baseline 
packaging  arrangement  is  developed. 

System  design  decisions  are  summarized  in  paragraph  4.7. 

4.1  General  Design  Requirements 

Section  III  of  this  report  gives  the  requirements  imposed  on  the 
redundant  strapdown  INS  by  the  application.  These  requirements 
stem  from  various  customer  or  potential  customer  needs,  including 
those  imposed  by  the  total  operational  environment.  Internal  to 
redundant  strapdown  INS,  additional  design  constraints,  guide- 
lines or  assumptions  may  be  imposed  prior  to  system  synthesis, 
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either  to  achieve  more  realistic  cost /reliability  estimates  or 
based  on  current  manufacturing  trends. 

4.1.1  General  Construction 

The  general  construction  of  units  has  a strong  impact  on  cost, 
both  unit  cost  and  in-service  cost.  The  following  guidelines 
will  be  applied  to  the  preliminary  design  of  the  redundant 
strapdown  INS: 

• Simplicity  of  construction  is  more  important  than 
minimum  size. 

• Internal  inter-module  wiring  should  use  low-cost  produc- 
tion techniques  such  as  fxex-print,  multilayer  laminates, 
or  automatic  wiring  machines,  as  applicable,  with  that 
order  of  preference. 

• Electronic  modules  should  be  designed  to  use  modern 
production  assembly  methods  such  as  automatic  component 
insertion  and  wave  soldering,  as  applicable.  Hand- 
soldering should  be  minimized. 

• The  total  number  of  electronic  modules  (printed  circuit 
boards)  should  be  limited,  consistent  with  vibration 
integrity  and  modularity  needs,  to  reduce  the  number  of 
connectors,  total  printed  circuit  board  cost,  and  test 
cost.  A multitude  of  small  assemblies  should  be  avoided. 

4.1.2  Module  Designs 

The  gyro  design  will  be  assumed  to  be  the  Litton  G-6,  tuned- 
gimbal  gyro.  The  accelerometer  will  be  the  production  Litton 
A— 1000  (single  axis). 

The  electronics  designs  should  use  low-power  techniques  where 
practical.  Having  a low  power  requirement  not  only  reduces 
power  supply  costs,  but  also  simplifies  electronics  packaging. 
Heat  exchangers  may  be  eliminated  or  simplified  and  the  overall 
structure  may  be  reduced.  Reliability  also  benefits  from  lower 
component  operating  temperature.  In  addition,  aircraft  battery 
requirements  to  cover  power  interruptions  are  simplified. 

Power  supply  cost  may  be  further  reduced  by  standardizing  power 
supply  voltages.  A fewer  number  of  voltages  to  be  generated 
tends  to  cut  down  on  the  number  of  regulators  needed. 

The  expanded  use  of  digital  components  in  the  electronic  design 
(with  a corresponding  reduction  of  analog  components , such  as 
operational  amplifiers,  capacitors,  and  even  resistors)  is 
highly  desirable.  Digital  component  technology  is  evolving  very 
rapidly  through  the  use  of  MSI  and  LSI  (medium  and  large-scale 
integration)  techniques.  Component  costs  are  reducing 
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dramatically,  with  lowered  power  dissipation  and  use  of  a single 
power  supply  voltage  (normally)  as  added  benefits. 

The  digital  computer  which  will  be  assumed  for  the  purposes  of 
the  study  is  a modern  hi-perf ormance  strawman  machine  utilizing 
state-of-the-art  components  while  meeting  the  strapdown  speed 
requirements.  Computers  in  this  class  are  state-of-the-art  and 
available  in  quantity  at  competitive  prices.  The  computer 
memory  will  be  a semiconductor  version.  A core  memory  may  be 
used  for  flight  test  of  early  models  of  the  redundant  strapdown 
INS  for  software  validation.  Production  models,  however,  would 
benefit  from  the  lower  cost  of  semiconductor  memory. 

4.1.3  Software  Generation 

It  will  be  assumed  that  the  software  will  be  generated  in 
assembly  language  rather  than  in  some  higher  order  language  such 
as  FORTRAN  or  JOVIAL.  Inefficiencies  incurred  with  compilers  as 
well  as  difficulties  in  real-time  application  result  in  20%-50% 
memory  word-count  and  time  penalties.  The  lowest  unit  cost, 
therefore,  will  result  from  the  most  efficient  computer  program- 
ming. This  trade-off  should  be  reviewed  when  the  computer  is 
selected  for  the  implementation  phase  of  the  redundant  strap- 
down  program.  Computer  memory  costs  are  becoming  so  low  that 
some  memory  hardware  could  be  wasted  if  the  costs  of  programming 
can  be  significantly  reduced. 

4.1.4  Test  and  Calibration 

Computer- control led  module/unit  test  and  calibration  will  be 
assumed  for  minimum  cost.  This  will  have  a significant  impact 
on  unit  price  since  electronic  labor  costs  are  already  small 
through  the  use  of  automated  assembly  methods. 

The  design  of  the  redundant  strapdown  INS  units  and  modules 
should  include  capability  of  automatic  test.  This  determines 
the  number  and  type  of  test  points  (this  may  require  additional 
or  larger  connectors)  and  some  additional  components  for  iso- 
lation of  sensitive  circuits. 

4.2  Element  Block  Diagrams 

The  system  design  will  now  be  synthesized  from  the  basic,  non- 
redundant  constituents.  Various  alternative  mechanizations  are 
shown,  and  trade-off  discussions  presented  where  applicable. 

4.2.1  Non-Redundant  System  Block  Diagram 

A simplified  block  diagram  of  a non-redundant  strapdown  INS  is 
shown  as  figure  4-1.  The  G-6  tuned-gimbal  gyro  has  two  degrees- 
of-freedom  and  thus  there  is  a redundant  (R)  channel.  In  addi- 
tion, it  is  essentially  a displacement  gyro,  as  opposed  to  a 
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rate  gyro.  Therefore,  an  amplifier  is  needed  to  derive  angular 
rate  by  precessing  (torquing)  whenever  an  angular  displacement 
(pick-off)  occurs.  Similarly,  accelerometers  are  of  the  torque- 
to-balance  type  where  an  amplifier  produces  an  electrical  cur- 
rent into  the  electromagnetic  torquer  of  the  accelerometer. 

This  torque  balances  out  the  torque  produced  by  the  vehicle 
acceleration  acting  through  a pendulous  mass  in  the  instrument. 

Gyro  and  accelerometer  torquer  signals  must  be  converted  into  a 
form  which  the  computer  can  use  and  this  conversion  is  desig- 
nated IMU/computer  I/O.  After  solution  of  alignment,  attitude 
and  navigation  equations,  the  computer  forms  the  required  out- 
puts for  the  aircraft  avionics.  Inputs  are  also  accepted  by  the 
strapdown  INS  for  update  purposes.  Special  circuitry,  assumed 
to  be  all-digital,  is  required  for  this  system  I/O  since  the 
computer  signal  format  is  not  usually  adaptable  for  use  with 
aircraft  wiring. 

An  alternative  gyro  and/or  accelerometer  torquing  method  is 
shown  on  figure  4-1  with  dashed  lines.  In  this  method,  the  com- 
puter closes  the  loop  around  gyros  and/or  accelerometers,  thus 
simplifying  the  analog  amplifiers.  Since  a single  computer 
cannot  solve  both  the  loop  closures  and  the  strapdown  equations 
due  to  the  speed  limitations  of  modern  computers,  additional 
computational  capacity  must  be  added.  This  will  not  be  dis- 
cussed further  in  this  report  since  it  is  more  of  a detailed 
circuit-design  rather  than  system-design  option. 

4.2.2  Gyro  Mechanization 

The  G-6  gyro  input  and  output  requirements  are  shown  in  figure 
4-2.  System  mechanization  factors  which  need  consideration  are: 

• Gyro  rebalance  loop  design. 

• Temperature  sensitivity  correction. 

• Spin  motor  power. 

• Pickoff  excitation  supply. 

• Angular  axis  alignment  methods. 

Gyro  Rebalance  Loop  Design 

The  G-6  tuned  gimbal  gyro  input /output  characteristics  are  shown 
in  figure  4-2.  Since  it  is  basically  a limited  range  displace- 
ment gyro  rather  than  a rate  gyro,  electronics  is  needed  to 
sense  displacements  and  drive  them  to  a null.  The  driving 
signals  into  the  two  torquer  coils  are  a measure  of  the  vehicle 
angular  rate  about  two  axes. 
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Figure  4-1.  Non-Redundant  INS  Simplified  Block  Diagram 
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Loop  closure  can  be  performed  either  in  an  analog  fashion  or 
digitally.  Analog  rebalance  requires  an  analog-to-digital 
converter  for  input  of  rate  measurements  into  the  digital  compu- 
ter. An  analog  mechanization  is  sometimes  considered  to  have  a 
tighter  loop  gain  with  less  noise  than  a digital  technique.  The 
A/D  conversion  accuracy  requirement  on  the  other  hand,  is  very 
difficult  to  achieve.  Practical  circuits  have  been  implemented, 
however . 

A digital  mechanization  produces  loop  closure  by  means  of  pulses 
into  the  torquer  coil  rather  than  a direct  current.  It  is  not 
the  purpose  of  this  study  to  determine  the  most  cost-effective 
means  of  gyro  rebalance  loop  implementation,  but  Litton  prefers 
the  digital  method  over  analog  plus  A/D  conversion  on  the  basis 
of  minimum  circuitry. 

Reference  [ 1 3 ] describes  a number  of  pulse  torque  loop  mechani- 
zations. Litton  uses  a method  very  similar  to  what  is  termed 
"forced  binary  loop"  in  reference  |l3] . With  this  method,  a 
fixed  frequency  square  wave  is  derived  where  the  duty  cycle  is 
modulated  as  a function  of  the  gyro  pick-off  signal. 

Figure  4-3  illustrates  this  mechanization.  Each  marker  clock 
pulse  (approximately  2 KHz)  switches  a positive  current  into 
the  gyro  torquer  coil.  When  the  amplified,  shaped  pick-off 
signal  crosses  a threshold,  the  next  data  clock  pulse  (approxi- 
mately 400  KHz)  causes  the  current  to  switch  negative.  The  net 
number  of  data  pulses  between  marker  pulses,  counting  positive 
during  positive  torquing,  negative  during  negative  torquing,  is 
proportional  to  average  gyro  precession  rate  during  the  interval. 
External  counting  logic  determines  net  pulse  changes  between 
computer  sampling  intervals  for  input  of  Ad  to  the  computer. 

The  need  and  desirability  of  cross-coupling  between  the  two  gyro 
rebalance  loops  is  discussed  in  the  detailed  loop  design 
description  given  in  paragraph  6.2.1. 

The  wheel  pick-off  signal  may  be  used  to  detect  synchronization 
between  wheel  motion  and  motor  power  supply  frequencies  and  is 
thus  useful  for  self-test  purposes. 

The  advantages  of  the  forced  binary  loop  implementation  are: 

a.  For  high  marker  pulse  rate,  the  loop  is  essentially 
analog,  and  thus  linear,  resulting  in  high  closed-loop 
gain  and  band-width.  Selection  of  high  marker  pulse 
rate  reduces  digital  noise  to  acceptable  levels. 

b.  Good  Ad  resolution  can  easily  be  achieved  (0.5  arc 
second) . 

c.  Power  into  the  torquer  coil  is  constant,  resulting  in 
constant  gyro  thermal  characteristics  and  improved 
performance. 
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Figure  4-3.  Digital  Gyro  Rebalance  Loop  Mechanization 
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d.  Parts  count  is  reduced  over  the  analog-A/D  method. 

e.  Excellent  posit ive-to-negative  torquing  symmetry  can  be 
achieved. 

The  "sampling  error"  described  in  [l3]  for  this  mechanization  is 
easily  eliminated  by  synchronization  of  computer  interrupts  with 
marker  pulses,  or  by  buffer  registers. 

A critical  aspect  of  any  rebalance  loop  implementation  is 
retaining  stable  symmetry  between  positive  and  negative  torquing 
scale  factors.  Any  asymmetry  drift  from  a calibrated  condition 
causes  errors  when  the  vehicle  is  in  a dynamic  environment 
through  a rectif ication  of  positive/negative  motion.  Achieving 
0.01%  scale  factor  stability  (100  ppm)  is  a lesser  challenge. 

Null  stability  errors  are  a function  of  the  balance  between 
positive  and  negative  torquing,  including  pulse  rise-time  and 
fall-time  contributions.  These  are  difficult  parameters  to 
control  and  require  careful  circuit  design.  Since  this  bias 
error  is  proportional  to  the  maximum  torquing  rate,  and  very  high 
vehicle  rates  (up  to  4 radians  per  second)  are  present  for  very 
short  time  durations,  a rate  switch  is  included.  One  current 
level  representing  30°/sec  is  used  during  normal  operation.  A 
second  current  level,  240° /sec,  is  applied  during  extreme  vehicle 
maneuvers . 

If  the  aircraft  autopilot  is  rate-limited  in  all  three  axes  for 
passenger  comfort  or  other  reasons,  this  extra  rate  switching 
circuitry  is  generally  not  used.  Safety  considerations,  however, 
require  that  the  sensor  measurement  range  be  higher  than  the 
basic  airframe  capability. 

Temperature  Sensitivity  Correction 

The  gyro  and  rebalance  electronics  parameters  are  designed  to 
have  low  sensitivity  to  operating  temperature.  There  are  limits 
to  how  insensitive  these  devices  can  be  made,  however.  The 
residual  coefficients  are  sufficiently  stable  with  time  so  that 
the  net  system  error  budget  can  be  achieved  either  with 

• rapid  component  warmup  and  temperature  control , or 

• monitoring  of  component  operating  temperature  with 
computer  corrections  applied  using  factory-calibrated 
coefficients. 

The  advantages  of  the  calibration  method  are: 

• system  power  consumption  is  reduced 

• component  operating  temperature  is  lower , resulting  in 
improved  reliability. 


61 


403314 


Additional  benefits  derived  from  avoiding  a large  thermal 
transient  at  turn-on  are:  1)  Electronics  failures  are  often 

induced  by  the  stresses  associated  with  large  thermal  gradients, 
so  net  reliability  is  further  improved  over  straight  parts- 
count  considerations:  2)  A thermal,  and  thus  instrument  perfor- 
mance transient  during  ground  alignment  is  eliminated.  Such  a 
transient  can  seriously  contaminate  gyrocompassing  if  not  con- 
trolled. The  instrument/electronic  thermal  design  becomes  very 
critical  in  temperature-controlled  systems  so  that  transients  are 
completed  soon  enough  to  achieve  alignment  in  the  required  10 
minutes. 

Increased  calibration  costs  result  with  this  method,  however, 
since  instrument/electronic  constants  must  be  derived  at  a number 
of  temperatures  instead  of  at  a single  point.  Test  equipment 
complexity,  test  time,  and  the  number  of  testers  needed  for 
significant  production  rates  are  all  increased. 

The  final  tradeoff  of  whether  or  not  to  tenperature- control 
instruments  is  left  until  the  final  production  equipment  design. 
System  design  is  described  for  a compensated  implementation. 

Spin  Motor  Power 

The  G-6  gyro  spin  motor  has  been  designed  to  operate  with  a 
square-wave,  three-phase  supply  voltage.  This  allows  use  of  a 
high-efficiency  switching- type  power  source. 

Tuned  gimbal  gyros  are  susceptible  to  vibrations  at  the  spin 
speed  and  especially  at  twice  spin  speed.  Therefore,  if  each 
gyro  is  run  at  a slightly  different  spin  speed, coupling  between 
gyros  through  self- induced  vibration  effects,  such  as  bearing 
noise  is  avoided.  If  this  coupling  is  significant,  separate  spin 
motor  power  supplies  are  needed  for  each  gyro. 

A signal  is  available  from  the  G-6  gyro,  the  wheel  pickoff, 
providing  a voltage  pulse  for  each  rotation  of  the  gyro  wheel. 
This  signal  is  useful  for  self-test  purposes  to  detect  gyro 
motor  or  major  bearing  failures.  The  pulse  frequency  is  equal 
to  1/4  the  motor  power  supply  frequency  when  the  motor  is  operat- 
ing synchronously.  This  pulse  train  could  also  be  used  to 
determine  motor  hunting,  and  thus  compensate  for  some  dynamic 
gyro  errors.  This  type  of  compensation  is  not  expected  to  be 
needed  in  a CH-46  type  of  environment,  as  described  in  paragraph 
4.5.3. 

Pickoff  Excitation  Supply 

The  supply  for  gyro  pickoff  excitation  is  of  straightforward 
design.  It  must  be  sinusoidal,  however,  with  low  harmonic 
content . 
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Angular  Axis  Alignment  Methods 

Gyro  axis  misalignments  of  the  spin  axis  and  the  torquer  axes, 
relative  to  the  mounting  structure,  are  needed  to  be  known  to  an 
accuracy  of  approximately  10  arc  seconds.  The  cost  of  machining 
to  this  tolerance  would  be  quite  high,  so  the  approach  assumed 
is  to  machine  to  relatively  loose  tolerances  and  then  calibrate 
the  misalignment  angles  during  test.  Thus,  gyro  axis  misalign- 
ments will  be  derived  during  the  calibrations  described  for 
temperature  compensation,  though  these  will  probably  not  vary 
with  operating  temperatures.  This  adds  four  constants  per  gyro 
to  be  stored  in  a non-volatile  memory  for  read- in  by  the  computer 
at  the  start  of  each  flight. 

4.2.3  Accelerometer  Mechanization 

The  characteristics  of  the  A-1000  accelerometer  are  very  similar 
to  that  of  the  gyro,  except,  of  course,  there  is  no  spin  motor. 
The  accelerometer  rebalance  loop  may  be  mechanized  in  a manner 
very  similar  to  the  gyro  loop.  Again,  a digital  loop  is  favored 
for  reduced  parts  count. 

Accuracy  requirements  for  the  accelerometer  rebalance  loop 
torquing  are  slightly  less  stringent  than  for  the  gyro,  espe- 
cially during  flight.  Approximately  10  ppm  repeatability  (100 
micro-g  out  of  lOg  maximum)  is  typically  acceptable.  During 
ground  alignment,  however,  accelerometer  bias  drifts  are  in- 
distinguishable from  gyro  bias.  Equivalent  bias  drift  must  be 
under  3 micro-g  per  minute  (0.01° /hr)  to  achieve  reasonable 
ground  alignment  accuracy.  Pulse  torquing  circuitry  can  be  of 
a common  design  between  the  gyro  and  accelerometer,  except  that 
there  is  no  mode  equivalent  to  the  high  rate  condition  in  the 
accelerometer  loop.  Also,  avoiding  temperature  control  with 
its  attendant  transient  will  aid  in  achieving  the  low  bias  drift 
needed  during  ground  alignment. 

4.2.4  IMU/Computer  Interface 

The  interface  between  the  Inertial  Measurement  Unit  components, 
the  gyros  and  accelerometers,  and  the  digital  computer  is  shown 
in  the  block  diagram  of  figure  4-4.  The  diagram  is  structured 
for  a complete  inertial  navigator  including  two  gyros  (with  one 
redundant  axis)  and  three  accelerometer  axes.  Gx  through  GR  are 

the  duty-cycle  modulated  square-waves  from  the  gyro  digital  re- 
balance loops  and  A through  A are  the  equivalent  signals  from 

X z 

accelerometer  loops  * 

The  conversion  of  duty-cycle  modulated  square— waves  to  a parallel 
digital  word  for  entry  into  the  computer  is  performed  by  the 
up-down  counters.  While  gyro  or  accelerometer  torquer  current 
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is  positive  the  count  in  a register  increments  at  some  fixed 
clock  rate.  When  torquer  current  switches  negative,  the  regis- 
ter count  decrements.  The  net  counter  value  over  one  digital 
torquing  interval  (approximately  500  microseconds  for  gyros,  250 
microseconds  for  accelerometers)  is  representative  of  the  angu- 
lar change  of  the  vehicle  about  that  axis  during  the  interval 
for  gyros,  and  velocity  change  for  accelerometers.  No  unusual 
design  techniques  are  needed  for  this  function  since  clock  rates 
of  approximately  400kHz  can  be  employed. 

The  main  constraint  is  that  the  digital  rebalance  duty-cycle 
transition  occurs  only  at  one  of  the  counter  clock  pulses  so 
that  no  information  is  lost. 

Temperature  sensors  are  required  at  the  instruments  for  computer 
compensation.  These  sensors  are  typically  a variable  resistance 
element,  such  as  platinum,  which  are  put  into  a bridge  circuit, 
the  output  of  which  may  be  a dc  voltage  proportional  to  tempera- 
ture. Thus,  a 10-bit  analog- to-digital  converter  is  needed  to 
develop  the  digital  words  for  application  to  the  computer  data 
bus.  The  number  of  sensors  needed  depends  upon  the  thermal 
design  of  the  instrument  block  and  the  thermal  gradients  expected 
under  a variety  of  environments  and  power  conditions. 

Since  the  digital  rebalance  circuits  have  their  own  sensitivity 
to  temperature,  gradients  between  the  gyro  temperature  sensor  and 
the  thermally  sensitive  electronic  components  with,  for  example, 
different  cooling  air  flows  must  also  be  considered.  Adding  a 
temperature  sensor  to  the  electronics  implies  that  instruments 
and  electronics  are  calibrated  at  the  factory  separately.  This 
not  only  increases  cost  but  also  may  be  impractical  due  to  the 
accuracy  requirements.  Therefore,  rebalance  electronics  will  be 
closely  packaged  with  their  corresponding  instruments  to  assure 
a common  thermal  environment,  and  then  will  be  calibrated 
together. 

4.2.5  Digital  Computer  Design 

The  basic  computer  performance  and  memory  requirements  for 
strapdown  navigation  are  defined  elsewhere  in  this  report. 

Other  aspects  of  the  computer  design  such  as  architecture,  I/O 
provisions,  etc.,  are  functions  of  detail  design  trade-offs 
rather  than  preliminary  design.  This  type  of  trade-off  con- 
siders design  features  which  may  add  to  unit  CPU  cost  but  reduce 
memory  cost  and/or  one-time  programming  costs.  Only  general 
design  trends  likely  to  be  applicable  to  a strapdown  INS  will  be 
covered  in  this  preliminary  design  report. 

16-bit  computer  architecture  is  used  extensively  in  the  mini- 
computer field  for  data  words,  with  single  or  multiple  words 
used  as  instructions.  24— bit  computers  are  sometimes  used  in 
avionics  for  simplified  addressing  and  reduced  double-precision 
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requirements.  The  strapdown  problem  requires  a significant 
amount  of  higher-precision  arithmetic  so  some  32-bit  arithmetic 
capability  is  very  desirable.  This  function  is  included  in  the 
typical  instruction  mix  used  in  the  throughput  definition 
described  in  paragraph  6.3,  so  is  contained  in  the  throughput 
specification.  In  other  words,  the  problem  may  be  solved  by  a 
fast  16-bit  computer  using  software  32-bit  subroutines,  or  by  a 
slower  computer  having  hardware  32-bit  arithmetic.  The  lower- 
cost  unit  meeting  the  throughput  requirement  is  the  natural 
selection.  The  added  memory  for  the  32-bit  subroutines  should 
also  be  considered,  but  the  downward  cost  trends  of  semiconductor 
memory  make  this  a relatively  small  factor.  16-bit  architecture 
with  good  32-bit  arithmetic  capability  is  assumed  for  the  base- 
line redundant  strapdown  computer. 

Floating-point  arithmetic  is  also  a highly  desirable  feature, 
primarily  to  simplify  the  variable-scaling  aspects  of  program- 
ming. While  the  wider  dynamic  range  is  a help  in  some  cases,  it 
is  not  as  essential  as  in  a problem  such  as  Kalman  filtering 
where  convariances  can  assume  such  a wide  range  of  values.  To 
be  of  use,  the  floating  point  capability  would  need  to  be  rea- 
sonably fast  and  use  a mantissa  of  24-bits  or  greater.  Fixed 
point  capability  would  still  need  to  be  retained  in  the  computer 
for  high-speed  portions  of  the  problem.  Low  cost  implementations 
of  floating  point  arithmetic  are  generally  significantly  slower 
than  fixed-point. 

The  use  of  index  registers  as  pointers  to  memory  areas  has  been 
found  very  valuable  in  simplifying  programming  and  reducing 
memory.  The  general  trend  is  to  have  some  of  the  index  registers 
also  capable  of  operation  as  an  accumulator  (general  register) , 
with  register-to-register  arithmetic  capability.  These  type  of 
non-memory-reference  operations  are  usually  very  fast  and  add  to 
net  throughput  performance. 

Many  modern  computers  have  microprogrammable  instruction  sets  so 
they  can  more  easily  be  tailored  to  a specific  application  and/or 
available  software.  Thus  a computer  can  be  configured  to  emulate 
a previous  design,  with  potentially  significant  savings  in  soft- 
ware generation  costs,  or  a particular  instruction  may  be  inclu- 
ded for  a more  efficient  solution  of  the  problem.  For  the  strap- 
down  problem,  for  example,  there  may  be  an  instruction  format 
which  could  solve  the  quaternion  integration  with  lower  word- 
count/duty-cycle  impact.  Speed  may  be  improved  if  the  instruction 
takes  the  place  of  several  normal  instructions,  since  only  a 
single  instruction-fetch  is  required.  Execution  time  of  normal, 
long  instructions,  however,  such  as  multiply  and  divide,  is 
degraded,  if  these  are  microprogrammed  instead  of  implemented  in 
hardware.  Thus,  net  performance  gains,  if  any,  need  to  be 
clearly  established. 
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Most  modern  computers  can  be  configured  to  perform  input/output 
operations  either  under  software  control  or  under  hardware 
control  through  direct  memory  access  (DMA)  by  the  external 
device  during  times  the  CPU  is  not  accessing  memory.  DMA  capa- 
bility is  very  useful  in  many  applications  in  conserving  duty 
cycle. 

The  software  of  a real-time  problem  is  often  controlled  by  means 
of  an  interrupt  pulse.  These  pulses,  occurring  at  some  fixed 
rate  control  the  software  executive.  Counting  of  these  pulses 
is  then  used  to  schedule  the  various  software  tasks.  An  addi- 
tional interrupt,  usually  the  primary  interrupt,  is  used  to 
start  a sequence  of  software  operations  in  the  event  of  loss  of 
primary  power.  An  example  of  such  an  operation  is  the  rapid 
storage  of  self-test  results  in  non-volatile  memory  to  aid  in 
post-flight  evaluation  of  failures.  A fairly  simple  computer 
interrupt  mechanization  can  be  suitable  to  vector  the  software 
to  the  correct  memory  location  containing  the  interrupt  sub- 
routine. Extensive  multi-level,  vectored  interrupt  schemes  are 
not  required.  Special  design  features  needed  for  redundancy 
are  discussed  in  a later  section. 

The  total  computer  memory  requirement  may  be  divided  into  four 
categories : 

a.  Program  memory 

b.  Scratchpad  memory 

c.  Electrically  alterable,  non-volatile  memory 

d.  Factory-derived,  instrument  constant  memory 

The  program  memory  contains  the  sequence  of  instructions  to  be 
performed  by  the  CPU.  Many  types  of  computer  applications 
require  that  the  instruction  memory  be  electrically  alterable 
(but  non-volatile  when  power  is  off)  so  that  program  changes 
can  be  easily  incorporated.  Core  memories,  CMOS  semiconductor 
RAM  with  a battery  for  non-volatility,  and  silicon  nitride  MOS 
devices  fall  into  this  category.  Ultra-violet-erasable  PROM 
also  provides  program  modification  flexibility. 

Since  the  redundant  strapdown  INS  as  presently  conceived  is 
basically  a sensor,  it  is  assumed  that  the  software  will  have 
very  few  changes  once  the  system  is  debugged  and  proven.  There- 
fore, low-cost  ROM  (read-only  semiconductor  memory)  will  be 
assumed.  This  memory  will  also  contain  various  constants  needed 
for  program  execution.  A variety  of  devices  of  this  type  are 
currently  available  at  low  cost  with  more  than  adequate  speed 
for  this  application. 

Scratchpad  memory  provides  temporary  storage  for  system  vari- 
ables, flags,  etc,,  during  processing  and  I/O  operations.  It  may 
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be  volatile  since  battery  protection  against  short  power 
interruptions  will  be  provided  for  the  entire  system,  and  the 
variables  are  all  reinitialized  when  the  system  is  energized  at 
the  start  of  a flight. 

Some  variables  are  required  to  be  retained  following  system 
deactivation,  however.  For  example,  position  coordinates  of  the 
aircraft  at  shutdown  may  be  used  during  the  next  start-up 
sequence  if  accumulated  system  errors  are  not  too  great.  Some 
system  calibrations  such  as  partial  gyro  biases  need  to  be 
retained  so  that  further  biasing  during  the  next  flight  can 
inprove  on  past  estimates. 

In  addition,  it  is  very  useful  to  retain  a record  of  system 
variables  and  redundancy  management  or  self -test  results  after  a 
failure  is  indicated.  Since  many  failure  modes  cause  a rapid 
power  shut-down  (100  usee  is  typical)  to  avoid  chain- type 
failures,  the  write  time  of  the  non-volatile,  read/write  memory 
holding  these  variables  must  be  faster  than  the  power  supply 
shutdown  time  constant.  Silicon  nitride  memories  now  becoming 
available,  cannot  be  used  for  this  function  since  write-times 
are  too  long. 

The  total  read/write  memory  function  is  assumed  to  be  implemented 
with  a CMOS  memory  supported  by  a small  battery.  Several  months 
of  non-volatility  can  be  obtained  with  such  a small  battery. 

SOS  (silicon  on  sapphire)  versions  of  CMOS  are  now  becoming 
available  with  adequate  speed  for  this  application. 

The  instrument  constant  memory  (a  read-only  memory  which  is 
programmed  only  once  using  a special  item  of  test  equipment)  is 
required  to  store  some  instrument  constants  which  are  not  nor- 
mally subject  to  change.  This  includes  instrument  non- 
orthogonalities which  are  determined  during  manufacture.  A 
silicon  nitride  memory  is  not  recommended  since  certain  types 
of  computer  failures  might  cause  alteration  of  the  constants, 
thus  necessitating  instrument  recalibration,  a time-consuming 
maintenance  action.  The  instrument  constant  memory  would  be 
implemented  in  a programmable  ROM  ( PROM) . 

4.2.6  Computer  Input /Output 

The  input/output  between  the  digital  computer  and  other  aircraft 
avionics  has  been  designated  to  be  all-digital,  serial  and  in 
the  format  defined  in  ARINC  575.  For  the  non- redundant  configu- 
ration, there  are  no  unique  design  problems  associated  with  this 
circuitry. 
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4. 2.7  Power  Supply  and  Support  Electronics 

The  remainder  of  electronics  needed  to  complete  a non-redundant 
strapdown  INS  is  shown  in  block  diagram  form  in  figure  4-5. 
Primary  aircraft  power  is  converted  to  DC  which  is  used  to 
derive  the  various  voltages  needed  by  the  electronic  components. 
It  is  also  used  to  charge  the  battery  which  provides  the  backup 
power  in  the  event  of  aircraft  power  interruptions. 

Self-test  circuits  monitor  critical  gyro,  accelerometer,  and 
power  supply  signals.  When  a failure  is  detected,  the  computer 
is  sent  an  interrupt  so  it  can  perform  its  shutdown  subroutine, 
and  a failure  indication  is  provided  to  other  aircraft  avionics. 

A variety  of  frequency  references  are  provided  by  the  crystal 
oscillator  and  countdown  circuitry  for  such  things  as  instru- 
ment pickoff  excitation,  gyro  spin  power,  digital  rebalance  loop 
control,  I/O  circuit  counting  and  timing,  computer  clock,  the 
software  executive  interrupt,  and  a computer-read  time  word  used 
in  the  solution  of  the  equations  to  compensate  for  computational 
time  delays.  A watch-dog  timer  is  also  incorporated,  reset 
periodically  by  software.  If  a problem  develops  and  software 
cannot  reset  the  timer,  self-test  circuits  are  activated  to 
indicate  a computer  failure. 

Mode  sequencing  circuits  are  used  to  initiate  gyro  spin  power 
once  power  supply  voltages  are  stabilized  and  close  gyro  and 
accelerometer  digital  rebalance  loops  once  gyro  motors  are  up  to 
speed. 

4.2.8  Software 

The  general  software  mechanization  of  a strapdown  inertial 
navigation  system  implemented  with  TDF  tuned-gimbal  gyroscopes 
is  shown  in  figure  4-6.  Following  read- in  of  counts  representing 
the  incremental  change  in  angle  and  velocity  occurring  over  the 
previous  sampling  interval,  in  instrument  coordinates,  software 
compensation  is  applied.  Compensation  converts  the  data  into 
the  body  coordinate  system  and  applies  correction  to  calibrated 
or  predictable  error  functions. 

Accelerometer  compensation  consists  of  a scale-factor  correction, 
rotation  of  data  through  calibrated  misalignment  angles,  and 
bias  correction.  Gyro  compensation  consists  of  similar  cor- 
rections plus  compensation  for  gravity-dependent  bias  and  dynamic 
error  mechanisms. 

The  type  of  dynamic  error  compensation  employed  depends  upon  the 
vibration  environment  of  the  vehicle,  gyro  parameters,  gyro 
rebalance  loop  characteristics,  and  the  desired  net  system 
accuracy.  There  is  a significant  penalty  in  use  of  computer 
duty  cycle  so  software  tends  to  be  tailored  to  the  application. 
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Figure  4-6.  Simplified  Block  Diagram  of  Strapdown  System  Software 
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The  most  significant  dynamic  compensation  used  in  strapdown 
applications  corrects  for  gyro  inertia  effects.  When  a gyro  is 
torqued,  it  not  only  processes  90°  from  the  torquing  and  spin 
axes,  but  also  deflects  about  the  torquing  axis.  This  is  a very 
predictable  effect  but  must  be  compensated  at  a high  speed  in 
software  to  minimize  errors  due  to  angular  vibration  of  the 
vehicle. 

Another  compensation  often  employed  uses  gyro  pick-off  displace- 
ments to  offset  rectification  which  could  occur  in  a vibration 
environment  due  to  finite  rebalance  loop  compliance.  This 
compensation  is  smaller  and  may  be  considered  for  elimination 
in  error  budget  trade-offs. 

Compensated  gyro  outputs  are  then  integrated  in  a quaternion 
integration  algorithm  to  determine  the  angle  between  the  aircraft 
body  coordinate  system  and  the  coordinate  system  used  in  the 
inertial  navigation  equations.  In  general,  higher  order  inte- 
gration algorithms  such  as  second  or  fourth  are  used  with  reason- 
able computer  solution  rates  to  prevent  errors  due  to  circulatory 
vehicle  vibration  (coning). 

Velocity  increments  are  transformed  from  body  coordinates  to 
navigation  coordinates  using  these  quaternions.  From  this  point 
on,  equations  to  be  solved  are  identical  to  the  inertial  navi- 
gation equations  of  gimballed  systems.  The  inertial  rate  of  the 
navigation  coordinate  system  is  also  derived  and  returned  to  the 
quaternion  integration  algorithm  in  a manner  directly  analogous 
to  gyro  torquing. 

Leveling  and  gyrocompassing  are  performed  on  the  ground  prior 
to  flight  in  the  same  manner  as  gimballed  inertial  systems. 
Time-varying  gains  are  normally  employed,  with  high  initial 
gains  to  remove  large  initial  conditions,  gradually  reducing  to 
a low  value  to  provide  filtering  of  either  internal  noise  effects 
or  unpredictable  motion  of  the  aircraft  due  to  wind  gusts, 
passenger  loading,  refueling,  etc.  The  optimum  time-schedule  of 
the  gain  is  often  determined  using  an  off-line  Kalman  filtering 
technique. 

The  design  of  compensation  and  quaternion  integration  must  be 
performed  carefully  to  avoid  undue  airborne  computer  time  con- 
sumption. In  a current  strapdown  program  at  Litton,  approxi- 
mately 40%  of  the  total  utilized  duty  cycle  was  consumed  by 
instrument  compensation,  40%  for  quaternion  integration  and  20% 
for  the  remainder  of  tasks.  Compensation  and  quaternion  time 
consumption  can  be  reduced  for  systems  with  reduced  accuracy 
requirements  or  reduced  vibration  environment,  or  can  be  reduced 
by  use  of  advanced  techniques  such  as  higher-order  algorithms, 
time- staggered  Afl,  AV  read- in,  and  special  microprogrammed 
computer  instructions. 
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4.3  System  Redundancy  Tradeoffs 
System  Design 

The  synthesis  of  the  remainder  of  the  redundant  strapdown  INS  is 
based  on  comparison  of  a channelized  approach  vs  lower  level 
modular  redundancy.  This  tradeoff  is  illustrated  by  figure  4-7. 
In  the  channelized  approach,  failure  of  any  element  of  the 
channel  (IMM,  computer,  I/O,  power  supply)  causes  failure  of  the 
entire  channel.  The  IMM  redundancy  management  requires  communi- 
cation between  channels  which  then  also  provides  the  instrument 
measurements  to  all  computers. 

The  modular  redundancy  approach  provides  fault  detection  and 
isolation  at  each  module  so  that  a failure  of  a power  supply  or 
computer,  for  example,  does  not  deactivate  any  other  module. 

The  reliability  of  this  method  is  higher  than  the  channelized 
approach,  at  some  extra  cost  for  monitoring  and  switching  hard- 
ware. This  is  a well-documented  redundancy  tradeoff  [14]. 

An  approximate  calculation  of  redundant  strapdown  INS  reliability 
with  the  channelized  approach  will  serve  to  scope  the  problem. 

If  reliability  is  marginal  with  this  method,  some  modular 
redundancy  would  need  to  be  introduced. 

One  channel  of  the  four  redundant  channels  is  expected  to  have 
an  MTBF  of  at  least  3000  hours.  This  is  consistent  with  relia- 
bility actually  experienced  on  ARINC  561/571  INS  of  1500-2000 
hours.  These  INS  contain  2 gyros,  3 accelerometers,  gimbals, 
sliprings,  servo  amplifiers,  considerable  input/output  circuitry, 
and  older,  less-integrated  component  technology  vs  1 gyro, 

2 accelerometer  axes,  minimum  I/O,  and  medium  and  large  scale 
integrated  (LSI)  circuitry  in  one  redundant  strapdown  INS 
channel . 

A calculation  of  system  reliability  must  take  into  account  the 
failure  coverage*  at  each  fail-operational  level.  The  sensi- 
tivity of  system  reliability  to  this  variable,  at  each  level,  is 
illustrated  in  figures  4-8a  and  4-8b  taken  from  reference  [16]. 

Figure  4-8a  (figure  3 of  [16]  ) shows  the  effect  of  non-unity 
coverage  for  the  first  failure,  with  a coverage  of  0.9  for  the 
second.  The  system  configuration  for  these  curves  is  three 
channels,  the  first  failure  detected  by  voting  and  the  second  by 
BITE.  While  this  condition  is  not  identical  to  the  redundant 
strapdown  INS,  reliability  trends  are  applicable.  It  is  clear 


♦The  term  "coverage"  has  been  defined  in  the  literature  [15] [16] 
as  the  likelihood  of  detection  and  recovery  given  that  a failure 
has  occurred.  Thus  coverage  measures  the  confidence  associated 
with  a fail-operational  capability. 
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Figure  4-7.  Channel  vs  Modular  Redundancy  Options 
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Figure  4-8.  Approximate  System  Reliability  vs  Coverage 
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that  nearly  perfect  coverage  for  the  first  failure  (C^)  is 

needed  to  make  full  use  of  the  inherent  equipment  reliability, 
preferably  better  than  0.99999.  One  source  of  imperfect  coverage 
is  the  detection  level  used  in  the  parity  equations  to  detect 
soft  gyro  or  accelerometer  errors.  This  detection  level  must  be 
set  high  enough  that  false  failure  isolation  due  to  normal 
measurement  noise  has  a very  low  probability. 

Figure  4-8b) , a combination  of  figures  6 and  7 of  [l6],  illus- 
trates the  effect  of  non-unity  coverage  of  the  second  failure. 

The  top  curve  represents  a 3-channel  system  with  voting  logic 
(coverage  of  unity  for  one  failure)  and  no  BITE.  This  is  analo- 
gous to  zero  capability  to  fault- isolate  the  second  gyro  failure. 
The  second  two  curves  show  addition  of  BITE  with  increasing 
probabilities  of  correct  fault  detection  and  isolation.  The 
fourth  curve  is  a 4-channel  voted  system  (triple  modular  redun- 
dancy with  a standby  replacement  channel)  with  perfect  coverage 
for  two  failures.  From  these  curves  it  is  clear  that  coverage 
for  the  second  failure  should  be  greater  than  0.9,  preferably 
greater  than  0.99  to  make  full  use  of  the  inherent  equipment 
reliability.  The  analysis  of  the  next  section  of  this  report 
shows  the  practicality  of  achieving  greater  than  this  degree  of 
coverage  for  the  second  instrument  failure. 

From  these  curves,  it  appears  that  a reliability  of  approximately 
— 8 

1 X 10  (for  0.5  hr)  can  be  achieved  with  the  channelized 
approach,  assuming  a 3,000  hr  MTBF/channel  and  considering 
realistic  failure  coverage  conditions. 

The  previous  discussion  is  general  and  approximate.  A more 
rigorous  presentation  of  reliability  performance  for  the  selected 
system  configuration  is  given  in  paragraph  5.3  of  this  report. 

For  purposes  of  system  configuration  trade-offs,  however,  the 
following  conclusions  may  be  reached: 

a.  Low-level  redundancy  is  not  needed  to  meet  the  10-^ 
failure  probability  requirement  once  the  system  is 
configured  to  be  fail-op/fail-op,  except  where  neces- 
sary to  meet  coverage  requirements.  The  design  should 
be  driven  primarily  by  cost  factors. 

b.  Coverage  for  the  first  failure  should  be  greater  than 
0.9999,  preferably  0.99999. 

c.  Coverage  for  the  second  failure  should  be  greater  than 
0.99,  preferably  0.999.  A small  amount  of  BITE  cir- 
cuitry should  be  employed  to  achieve  this  goal. 

d.  BITE  circuitry  to  provide  fault  isolation  for  a third 
failure  is  not  needed.  The  primary  function  of  BITE 
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will  be  to  prevent  further  damage  following  a failure 
such  as  power  supply  burn-out,  gyro  hinge  damage,  or 
other  secondary  failures. 

As  an  illustration  of  the  first  point,  two  system  configurations 
may  be  considered.  Figure  4-9  shows  complete  redundancy  of 
computers*  and  system  input /output . The  computer  subsystem  may 
thus  be  designed  to  be  fault-tolerant  and  the  techniques 
described  in  the  literature,  [17]  and  [18]  for  example,  may  be 
applied  in  some  form.  This  often  includes  redundancy  at  the 
computer  module  level,  CPU  or  memory,  for  further  reliability 
improvement.  There  is  additional  hardware  needed  for  this 
redundancy,  however.  Each  computer  needs  to  be  able  to  accept 
data  from  all  four  IMM's,  and  the  redundant  I/O  needs  to  have 
considerable  monitoring  and  switching  circuitry. 

Based  on  the  need  for  a low  cost  design,  the  concept  of  figure 
4-10  is  recommended.  An  IMM  interfaces  with  only  1 computer, 
simplifying  that  hardware.  Data  is  made  available  to  other  com- 
puters for  IMM  redundancy  management  through  the  basic  inter- 
computer I/O.  External  I/O  is  dedicated  to  a computer  with  final 
voting  performed  by  the  equipment  tying  into  the  redundant 
strapdown  INS. 

This  recommended  approach  essentially  provides  redundancy  on  a 
channel  level.  Failure  of  any  element  of  the  channel  causes 
failure  of  the  entire  channel  but  not  the  failure  of  another 
channel.  This  is  consistent  with  the  earlier  conclusion  that 
low  level  redundancy  is  not  needed. 

The  assumption  that  external  subsystems  can  accept  four  inputs 
and  perform  their  own  voting  and  fault  masking  appears  reasonable 
in  light  of  redundant  systems  presently  in  service  and  since 
future  interfacing  systems  will  probably  contain  a computer  of 
the ir  own . 

Gyro  and  Accelerometer  Electronics 

Gyro  and  accelerometer  rebalance  loops  must  be  operating  con- 
tinuously to  provide  accurate  redundancy  management.  Therefore, 
there  is  no  circuitry  reduction  which  may  be  achieved  over  includ- 
ing separate  circuits  for  each  instrument.  Since  each  gyro 


*The  use  of  4 computers  was  a basic  assumption  of  this  study 
program  to  limit  the  required  amount  of  trade-off  analysis. 

While  3 computers  are  considered  to  have  fail-op/fail-op  capa- 
bility when  used  in  conjunction  with  BITE,  added  BITE  circuitry 
and  I/O  tends  to  offset  the  cost  reductions  offered  by  one  less 
computer.  This  is  particularly  true  considering  the  cost  trends 
of  computers  vs  special-design  I/O. 
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Figure  4-9.  Modular  Redundant  Configuration 
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Figure  4-10.  Selected  Channel  Redundancy  System  Configuration 
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operates  at  a slightly  different  spin  speed  to  eliminate  the 
possibility  of  errors  due  to  vibrational  crosscoupling,  four 
gyro  spin  supplies  are  also  desirable. 

IMM/Conrputer  Interface 

The  interface  between  the  instruments  and  the  computer  is 
actually  simpler  for  the  redundant  IMM  configuration  than  for  a 
non-redundant  Inertial  Measurement  Unit  (IMU).  This  is  due  to 
use  of  the  channelized  approach  previously  described  where  a 
computer  is  dedicated  to  a single  IMM  (1  gyro,  2 axes  of  accel- 
eration). This  dedication  not  only  reduces  the  number  of  inputs 
but  also  simplifies  timing  requirements  so  that  each  IMM/Computer 
channel  may  run  essentially  asynchronously  from  the  others. 

Digital  Computer 

The  recommended  system  approach  eliminates  the  need  for  hardware 
voting.  Any  comparison  of  data  between  channels  is  performed  in 
software.  This  then  eliminates  the  need  for  additional  levels  of 
interrupt  to  reconfigure  the  system, recover  from  transients,  etc. 
Thus  unique  design  features  are  not  needed  for  redundancy,  con- 
trolling cost. 

The  use  of  an  ROM  program  memory  is  considered  a Reliability 
Enhancement  Technique  since  it  cannot  be  altered  during  excessive 
noise  conditions.  It  would  be  desirable  to  have  the  capability 
of  reinitializing  the  RAM  since  the  integration  type  of  pro- 
cessing in  an  INS  does  not  recover  from  transient  failures.  This 
is  a rare  condition  so  only  minor  cost  penalty  should  be  incurred 
to  provide  it. 

Computer  I/O 

The  recommended  system  approach  where  a computer  is  dedicated  to 
a single  IMM  (1  gyro,  2 axes  of  acceleration)  requires  intercom- 
munication between  all  computers  in  the  system  in  addition  to 
communication  to  the  external  world.  It  is  assumed  for  purposes 
of  this  discussion  that  communications  to  the  external  world 
will  be  provided  via  standard  ARINC  575  Serial  I/O  Buses. 

The  inter- computer  communication  scheme,  however,  requires  care- 
ful consideration  since  it  can  greatly  affect  reliability  analy- 
sis and  redundancy  considerations.  A key  consideration  in  the 
system  design  should  be  a method  to  ensure  that  a faulty  pro- 
cessor cannot  destroy  data  in  another  processor. 

Approximately  75  variables  need  to  be  transferred  from  every 
computer  to  every  other  computer.  Transfer  of  variables  from  the 
other  three  computers  (225)  should  be  initiated  by  software  and 
be  available  in  a computer  before  the  next  executive  interrupt 
(128  per  second).  The  gyro  and  accelerometer  data  (6  words  per 
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computer)  should  be  transferred  first  since  the  software  must 
wait  before  performing  other  functions  until  these  measurements 
are  available  from  the  other  three  computers.  Thus  the  wait- 
time between  data  transfer  initiation  and  receipt  of  instrument 
data  consumes  computer  duty  cycle  and  should  be  minimized.  The 
use  of  DMA  for  data  transfer  is  highly  desirable  due  to  its 
speed  and  low  impact  on  duty  cycle. 

One  method  of  implementing  this  I/O  is  to  provide  every  memory 
unit  with  four  ports,  one  local  port  with  both  read  and  write 
capability  and  three  external  ports  with  read  only  capability. 
Each  computer  therefore  has  the  capability  of  reading  all  the 
state  variables  and  data  of  every  other  computer.  Software 
voting  algorithms  will  be  employed  to  effect  fault  detection  and 
recovery  processes. 

Two  port-methods  of  transferring  the  data  between  the  four 
computers  have  been  considered.  The  first  approach  is  to  use  a 
16-bit  parallel  bus  that  time  shares  data  and  address  lines. 
Assuming  approximately  four  control  lines  (Address  Strobe,  Data 
Strobe,  Memory  Request,  Memory  Enable)  for  completely  asynchro- 
nous operation,  this  approach  requires  at  least  80  signals  lines 
of  interconnect  between  the  four  systems  for  computer-to-computer 
communication.  It  has  the  inherent  advantage  of  being  simple 
to  implement  with  very  fast  response  time  to  error  detection. 

In  addition,  in  the  event  of  a channel  failure  just  prior  to 
take-off , substitution  of  a channel  and  IMU  reinitialization 
could  be  effected  rapidly  since  all  system  variables  are  avail- 
able and  may  be  transferred  from  the  three  active  systems  to  the 
replaced  system  within  a few  milliseconds. 

In  this  approach  the  RAM  memory  (approximately  1024  16-bit  words 
for  each  channel)  of  the  entire  system  is  contiguous  within  the 
memory  address  structure.  A discrete  bit  provided  in  the  elec- 
tronic harness  will  identify  to  the  software  the  channel  number 
(1,  2,  3 or  4)  of  the  local  processor.  If  a program  is  operating 

out  of  processor  2,  therefore,  it  will  be  able  to  read  addresses 
within  the  entire  spectrum  but  write  only  between  addresses  2K 
thru  3K.  It  is  assumed  that  with  parallel  busses  interconnecting 
the  four  computers,  data  can  be  read  directly  from  another 
channel  without  any  delay  or  extra  buffering. 

A second  port  method  is  to  use  a serial  transmission  scheme 
between  the  computers.  This  approach  can  reduce  the  signal  line 
interconnect  count  to  approximately  twelve  lines.  A serial-to- 
parallel  converter  is  required  at  each  receiving  memory  port  and 
a parallel-to-serial  converter  is  required  at  each  External 
Memory  Controller  (see  figure  4-lla).  The  disadvantage  of  this 
approach  is  the  relative  slowness  of  the  data  transfer  and  the 
extra  complexity  of  the  I/O  Controller. 
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a)  DATA  TRANSFER  VIA  READ  ONLY  MEMORY  PORTS 


WIRED 

ADDRESS  BITS 


b|  OATA  TRANSFER  VIA  CONVENTIONAL  SERIAL  I/O 

Figure  4-11.  Intercomputer  I/O  Options 
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In  a serial  scheme  the  delay  encountered  in  receiving  a given 
variable  may  adversely  effect  the  fast  iteration  loops.  There- 
fore a block  transfer  of  variables  is  assumed  and  a contiguous 
addressing  structure  for  the  four  computers  is  not  needed. 

The  serial  External  Memory  Controller  of  figure  4-lla ) can  accept 
the  following  type  command: 

Read  n variables  from  location  i — *i  + n from  system  s 
and  store  in  local  locations  1 — ^1  + n. 

The  command  is  sent  to  the  controller  and  the  CPU  then  continues 
with  another  program  task.  The  port  structure  of  the  memory  will 
contain  logic  to  ensure  that  no  single  requestor  can  hang  up  a 
RAM.  At  completion  of  the  data  transfer,  the  External  Memory 
controller  could  then  signal  the  requesting  processor  via  an 
interrupt . 

A third  method  of  data  transfer  is  illustrated  in  figure  4-llb) . 
When  data  is  ready  in  a particular  computer,  a programmed  I/O 
function  initiates  serial  data  transfer  from  that  computer  to  all 
other  computers.  When  the  serial  I/O  is  receiving  data  from  a 
particular  channel,  the  channel  number,  word  count  and  wired  bits 
are  used  to  form  the  memory  address  for  DMA  logic.  Use  of  this 
method  requires  that  there  be  no  component  failure  mode  which 
could  cause  multi-channel  failure. 

Selection  of  the  specific  inter- computer  I/O  mechanization  has 
been  deferred  to  the  detailed  design  phase.  No  matter  which 
method  is  selected,  careful  failure  analysis  must  be  performed 
to  retain  a fail-op/fail-op  capability  at  all  levels. 

Power  Supply  and  Support  Electronics 

The  power  supply  could  also  be  configured  to  be  modularly 
redundant,  i.e.,  a single  power  supply  failure  would  not  cause 
failure  of  any  other  system  element.  Since  monitoring  (BITE) 
circuits  for  power  supplies  are  relatively  straightforward,  only 

3 supplies  would  be  needed  for  fail-op /fail-op  capability. 
Coverage  could  be  made  adequate  for  both  failures. 

After  two  power  supply  failures,  however,  one  supply  is  driving 
all  4 channels.  Each  of  the  supplies  would  need  this  power  drive 
capability,  resulting  in  an  inherent  power  drive  capability  of 

4 X 3 or  12  channels,  only  4 of  which  are  applied  at  any  one 
time.  For  a channelized  approach,  a power  supply  is  preassigned 
to  a single  IMM /Computer . Thus  a net  drive  capability  of  only  4 
channels  is  required  for  the  total  redundant  strapdown  system. 
Since  power  supply  cost  is  strongly  dependent  upon  power  drive 
capability,  there  is  a significant  system  cost  penalty  for  the 
small  amount  of  increased  reliability  provided  by  modular  redun- 
dancy (not  even  considering  monitoring  and  switching  components 
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needed  to  switch-out  the  failed  unit).  Therefore,  a channelized 
approach  for  the  power  supply  is  selected,  where  a power  supply 
failure  will  cause  loss  of  one  IMM  and  one  computer  function. 

Self-test  circuits  are  applied  for  detection  of  hard  instrument 
and  power  supply  failures  to  assist  the  redundancy  management 
function  and  to  prevent  further  damage  to  instruments  or  other 
components  during  this  condition.  Power  shutdown  of  an  entire 
channel  would  be  activated  during  such  failures.  Therefore, 
these  self-test  circuits  are  best  designed  completely  on  a 
channel  basis,  having  minimum  or  no  interaction  with  other  channels. 

The  various  frequency  references  needed  for  system  implementation 
could  also  be  implemented  to  be  independently  redundant.  There 
is  a relatively  minor  amount  of  circuitry  involved  so  the  final 
decision  is  influenced  by  other  factors  such  as  packaging  and 
maintainability.  Again,  it  appears  that  having  separate  channels 
is  preferred  to  eliminate  elaborate  detection  and  switching 
circuits.  There  needs  to  be  some  interaction  between  channels, 
however,  to  approximately  synchronize  computations  so  that  data 
comparisons  are  made  following  calculations  within  the  same 
computer  iteration.  This  is  attained  by  producing  the  software 
executive  interrupt  simultaneously  in  all  4 channels.  Local 
clock  stability  would  then  produce  adequate  synchronization  for 
the  remainder  of  the  iteration.  Monitoring  and  switching  cir- 
cuitry is  needed  to  prevent  a single  failure  from  deactivating 
more  than  one  channel. 

Mode  sequencing  circuits  for  system  start-up  require  a minor 
amount  of  circuitry  to  produce  outputs  for  activation  of  a 
specific  channel,  such  as  computer  reset,  gyro  spin-up,  and 
loop  closures,  based  on  power  supply  mode  status.  Thus,  the 
design  clearly  requires  a channel  approach  vs  modular  redundancy, 
with  no  interaction  between  channels. 


4.4  Instrument  Redundancy  Trade-Offs 


4.4.1  General  Concepts 

The  preceding  channel  redundancy  approach  does  not  apply  to  the 
inertial  instruments.  Each  so-called  channel  contains  only  two 
axes  of  information  and  thus  is  not  a complete  navigator. 
Instruments,  therefore,  are  treated  in  a modular  fashion,  with 
Failure  Detection,  Isolation  (FDI)  and  subsequent  system  recon- 
figuration included  so  that  a single  instrument  failure  will  not 
cause  the  deactivation  of  any  other  instrument.  This  FDI  and 
reconfiguration  has  been  chosen  to  be  performed  in  computer 
software  for  lowest  system  cost. 

Definitions  of  the  following  terms  are  taken  from  reference  [19] . 
Detection  is  the  decision  that  a degradation  or  failure  has 
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occurred  at  a threshold  level  established  by  mission  phase 
requirements.  Isolation  is  the  subsequent  decision  of  which 
particular  instrument  output  is  responsible  for  the  system 
degradation  or  failure. 

A missed  alarm  is  defined  as  an  actual  failure  that  remains 
undetected  and/or  unisolated  after  the  desired  threshold  limit 
on  system  attitude  or  velocity  error  (or  any  other  such  detection 
criterion)  is  exceeded. 

False  alarms  occur  when  the  inertial  system  truly  has  no  failures 
but  transients  or  noise  trigger  the  FDI  system  to  falsely  indi- 
cate failure  of  a good  instrument.  False  and  missed  alarm 
probabilities  together  should  form  a valid  criterion  for  mea- 
suring the  effectiveness  (i.e.,  reliability)  of  a particular 
FDI  method.  A more  comprehensive  judgment  of  the  worth  of  FDI 
in  a particular  system  is  derived  by  judging  the  overall  relia- 
bility of  the  composite  system  by  combining  the  mean  time  before 
failure  (MTBF)  estimates  of  the  system  components  with  the  FDI 
false  and  missed  alarm  probabilities  over  the  critical  mission 
flight  time. 

Coverage  is  the  probability  of  a successful  system  recovery 
after  any  failure  has  occurred.  Coverage  then,  is  by  this  defi- 
nition, the  probability  of  a correct  alarm  when  a failure  occurs. 
It  is  not  a complete  overall  concept  because  it  does  not  take 
into  account  the  probability  of  the  FDI  method  having  a false 
alarm. 

4.4.2  Two-Deqree-Of-Freedom  Gyro  (TDF)  Considerations 

Much  of  the  published  work  on  strapdown  gyro  redundancy  manage- 
ment has  been  directed  toward  application  of  single-degree-of- 
freedom  gyros.  References  [20],  [21],  [22]  and  [23]  present 

some  of  the  dodecahedron  work  of  the  Charles  Stark  Draper  Labora- 
tory, [24]  , [25]  and  [26]  the  work  of  TRW  and  [27]  that  of 

Honeywell . 

A major  problem  in  the  use  of  single-degree-of-f reedom  (SDF) 
gyros  is  the  large  number  of  gyros  (6)  needed  for  fail-op/fail- 
op  capability.  This  leads  to  high  system  cost.  SDF  gyros  have 
not  differed  significantly  in  cost  from  TDF  gyros  in  the  past, 
and  this  fact  has  led  to  the  dominance  of  TDF  gyros  in  the 
highly  competitive  aircraft  inertial  system  marketplace.  The 
projections  to  strapdown  instruments,  such  as  the  laser  gyro 
($4,000  ea. , per  reference  [28])  indicate  the  same  trend. 

Noting  that  a 4-TDF  gyro  system  is  fail-op/fail-op  while  a 4-SDF 
gyro  system  is  only  fail-safe  highlights  this  comparison.  Con- 
siderable producibility  efforts  are  needed  on  laser  gyros  to 
offset  the  inherent  TDF  advantage  of  the  tuned-gimbal  gyro. 
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The  present  published  work  on  TDF  gyro  redundancy  management, 
references  [3],  Teledyne,  and  [29],  Kearfott  make  very  restric- 
tive assumptions  as  to  how  a TDF  gyro  will  fail.  Considering 
the  number  of  possible  failure  modes  and  the  extent  of  inter- 
action between  the  two  axes  of  a TDF  tuned-gimbal  gyro,  these 
assumptions  do  not  appear  warranted. 

Figure  4-12  illustrates  the  tuned-gimbal  gyro  components  and 
their  supporting  electronics.  Some  failure  modes  result  in 
drift  errors  on  a single  input  axis.  The  circuitry  which  trans- 
fers the  digital  data  from  each  axis  to  the  computer  for  example, 
may  have  single-axis  failure  modes.  This  depends  upon  the  actual 
mechanization,  however,  since  multiplexing  is  a common  digital 
design  technique.  The  portion  of  the  loop  electronics  or  gyro 
torquer  which  produces  precision  torquing  from  the  digital  sig- 
nal has  a number  of  soft  failure  modes  which  result  in  a dif- 
ference between  the  rate  indicated  to  the  computer  and  the  actual 
gyro  precession  rate  and  thus  a system  error.  Since  the  rebal- 
ance loop  may  still  be  operating  satisfactorily,  there  could  be 
little  or  no  cross- coupling  to  the  other  axis. 

Failures  of  components  which  are  used  in  common  between  axes, 
such  as  the  gyro  rotor  and  suspension  system,  magnet,  bearings 
and  motor,  result  in  degradation  of  performance  of  both  axes. 

In  addition,  errors  are  dependent  on  aircraft  maneuvers.  The 
error  due  to  a scale  factor  shift  depends  upon  the  axis  about 
which  the  aircraft  is  rotating.  An  error  due  to  a high 
g_sensit ivity  depends  upon  the  instantaneous  magnitude  and  direc- 
tion of  the  g-vector. 

Thus,  the  error  of  a TDF  gyro  should  be  considered  a vector 
quantity  in  the  measurement  plane  of  the  gyro.  There  also  exists 
some  probability  density  distribution  vs.  the  direction  of  the 
angle  with  higher  probability  densities  in  the  vicinity  of  the 
measurement  (torquer)  axes. 

4.4.3  3-Gyro  FDI  Singularities 

When  all  four  TDF  gyros  are  operating,  there  is  a considerable 
amount  of  redundant  information.  FDI  algorithms  leading  to 
100%  coverage  of  the  first  failure  are  relatively  straightfor- 
ward, regardless  of  the  gyro  failure  direction.  Detection  levels 
must  be  set  high  enough  above  normal  gyro  drift  transient  effects 
to  avoid  false  alarms  and  missed  alarms,  but  still  be  within  the 
level  set  by  system  accuracy  requirements. 

After  one  gyro  failure,  however,  the  ability  to  isolate  a second 
gyro  failure  is  somewhat  limited,  depending  on  the  magnitude  and 
direction  of  the  failure.  The  majority  of  gyro  failures  are 
catastrophic--they  fail  to  spin,  the  rebalance  loop  opens,  etc., 
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Figure  4-12.  Gyro  Assemblies  and  Gyro  Associated  Electronics 
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and  are  detectable  by  hardware  means.  The  computer  FDI  is  only 
concerned  with  soft  failures. 

The  FDI  limitations  for  the  3 TDF  gyro  conditions  may  be  con- 
veniently analyzed  considering  three  gyros  with  spin  axes 
orthogonal  and,  initially,  with  torquer  axes  along  the  three 
principal  axes. 

The  orientation  of  the  three  gyros  relative  to  the  reference 
coordinate  set  is  shown  in  figure  4-13.  Gyro  numbers  1,  2 and  3 
have  their  spin  axes  aligned  along  X,  Y,  and  Z axes  of  the  refer- 
ence coordinate  set.  The  gyro  outputs  are  denoted  by  u's  with 
subscripts  and  superscripts.  The  subscripts  denote  the  reference 
axis  about  which  the  measurement  is  made  and  the  superscripts 
denote  the  number  of  the  gyro  which  performed  the  measurement. 

Failure  isolation  equations  (parity  equations)  can  be  written 
by  inspection  of  figure  4-13,  as  follows. 


K1 

1 

2 

(1) 

= "z 

uz 

K2 

1 
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(2) 
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K3 

2 

3 
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Using  equations  (1),  (2),  and  (3)  we  may  construct  a truth  table. 

TABLE  4-1.  TRUTH  TABLE  FOR  ISOLATION  OF  A FAILED  GYRO  FOR 
3 ORTHOGONAL  TDF  GYRO  CONFIGURATION 
WITH  ORTHOGONAL  SENSING  AXES 


Gyro  # 
Failed 

K1 

K2 

K3 

None 

0 

0 

0 

1 

1 

1 

0 

2 

1 

0 

1 

3 

0 

1 

1 

In  the  Truth  Table  4-1,  the  symbol  of  unity  denotes  that  a 
failure  has  occurred  and  the  isolation  threshold  level  has  been 
exceeded.  The  symbol  zero  denotes  no  failure. 

Since  gyro  outputs  are  incremental  angles  subject  to  noise,  rate 
measurements  may  be  partially  integrated  for  smoothing.  There- 
fore, isolation  thresholds  are  often  expressed  in  angle  and 
thus  the  symbol  of  unity  represents  a state  in  which  the  set 
angular  threshold  has  been  reached  or  exceeded.  Isolation  error 
is  defined  as  the  total  angular  error  made  in  the  time  period 
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bounded  by  the  occurrence  of  a failure  and  determination  of  which 
gyro  caused  the  failure. 

During  certain  failure  modes,  only  one  of  the  parity  equations 
has  exceeded  its  threshold.  Therefore,  a determination  of  the 
failed  gyro  from  the  Truth  Table  cannot  be  made.  To  determine 
the  cause  and  effect  of  this  condition,  let  us  assume  that  a soft 
failure  has  occurred  in  gyro  No.  1 and  that  the  magnitude  and 
direction  of  this  failure  is  represented  by  an  error  vector  shown 
in  Figure  4-14.  This  error  vector  <t>  is  measured  relative  to  the 

gyro  axes  Y^  and  . Although  the  angle  9 may  assume  any  value 
between  0°  and  360°,  it  will  be  assumed  for  the  purpose  of  the 
initial  discussion  that  0 < 9 < 45°. 

It  is  noted  that  for  0 < 9 < 45°,  the  error  rate  along  the  Y1 

axis  is  larger  or  equal  to  the  rate  along  the  Z1  axis.  The  error 
angle  accumulated  along  the  gyro  No.  1 axes  is  shown  in  figure 

4-15.  At  the  time  ^ , the  output  of  the  Y1  axis  reaches  the 

angular  detection  threshold  level  <*>  . At  this  time  the  failure 

o 

detection  system  is  aware  of  the  fact  that  a failure  has  occurred. 
The  failure  isolation  mechanism  is  not  actuated  because  it  is  not 
known  whether  the  error  is  caused  by  gyro  No.  1 or  gyro  No.  3. 

Referring  to  equation  (2),  it  is  noted  that  K2  can  assume  a value 

of  unity  when  either  gyro  No.  1 or  No.  3 fails.  At  time  t~,  the 
1 2 
output  of  Z axis  reaches  the  angular  detection  threshold  level 
Thus  at  time  t2  the  failure  isolation  mechanism  is  actuated 

and  the  failed  gyro  No.  1 is  switched  from  the  system.  During 
time  t2,  isolation  error  has  been  accumulated.  From  figure  4-15, 

the  magnitude  of  the  isolation  error  as  a function  of  the  angle 
9 is  as  follows: 

Error  angle  accumulated  about  the  Z1  axis  is: 

<t>Q  = ( <t>  sin  9 ) t2  (4) 

Error  angle  accumulated  about  the  Y1  axis  is: 

( 4>  cos  9 ) t2  ( 5 ) 
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Assuming  the  error  angles  are  small  so  that  they  can  be  treated 
as  vectors,  then  the  resultant  isolation  error  is 


Substituting  t ^ from  equation  (4)  into  equation  (6), 


♦«  = 


= 4> 


*o  sin©  (7) 

The  isolation  error  in  nondimensional  form  is  shown  plotted  in 
figure  4-16.  Similar  reasoning  that  led  to  equation  (7)  can  be 
extended  for  values  of  45  < 0 < 360,  thus  obtaining  nondimen- 
sional isolation  error  for  0 < G < 360  as  shown  in  figure  4-17. 

As  seen  from  figure  4-17,  fault  isolation  singularities  (isolation 
error  approaching  infinity)  occur  for  gyro  error  directions  of 
0° . 90°,  180°  and  270°.  For  gyro  errors  along  these  directions, 
parity  equations  can  detect  that  an  error  has  occurred  (one  of  the 
parity  equations  exceeds  the  threshold  <J>o)  but  a determination 

cannot  be  made  as  to  which  gyro  has  failed.  In  table  4-1,  two 
parity  equations  must  exceed  their  detection  levels  for  fault 
isolation  to  occur.  If  only  one  equation  exceeds  the  detection 
level,  only  one  of  the  3 gyros  can  be  classified  as  good. 

With  gyro  sensitive  axes  aligned  along  principal  axes,  that  is 
coincident  with  the  spin  axis  of  another  gyro,  a single-axis  gyro 
failure  cannot  be  isolated.  Since  single-axis  gyro  failures  are 
expected  to  have  a slightly  higher  probability  of  occurence  than, 
for  example,  an  exactly  equal  drift  rate  about  both  axes  simul- 
taneously, it  is  appropriate  to  physically  rotate  the  sensitive 
axes  away  from  the  singular  directions.  A 45°  rotation  of  the 
gyro  about  its  spin  axis  was  suggested  by  Teledyne  in  reference 
[3] . This  reorientation  does  not  remove  the  singularities  but 
simply  moves  them  relative  to  probable  gyro  failure  modes. 

A physical  interpretation  of  the  singularities  may  be  obtained 
by  referring  to  figure  4-13.  In  the  direction  along  one  of  the 
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Figure  4-16.  Non  Dimensional  Isolation  Error 
For  0 <0  < 45° 
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Figure  4-17.  Failure  Isolation  Error  vs  Direction 
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3 

gyro  spin  axes,  say  H , there  are  only  two  measurements  of 

1 2 

angular  rate,  w and  w„  . If  an  error  in  gyro  #1  occurs  along 

Cx  Lj 

this  axis,  it  appears  in  only  one  parity  equation,  which  is 
insufficient  for  the  solution  of  two  unknowns,  the  two  gyro 
drift  rates.  Physical  rotation  of  the  torquers  about  the  gyro 
spin  axis  does  not  introduce  any  more  information  since  the  same 
effect  can  be  achieved  by  a computational  rotation. 

The  fault  isolation  singularities  occur  with  any  geometrical 
arrangement  of  three  TDF  gyros,  not  only  the  orthogonal  arrange- 
ment, except  for  the  trivial  case  of  three  coincident  gyros. 

The  impact  of  this  constraint  on  system  design  is  that  software 
must  be  configured  to  handle  the  rare  cases  of  failures  along 
the  singular  directions,  gyro  input  axes  should  be  oriented  away 
from  the  singular  directions,  and  total  system  reliability  is 
slightly  reduced  due  to  non-unity  coverage  of  the  second  failure. 
It  will  be  shown  that  coverage  is  much  closer  to  unity  for  large 
allowable  isolation  errors,  as  required  for  flight  control  use, 
than  for  navigation  errors. 

4.4.4  Gyro  Geometries 

The  geometry  selected  by  Teledyne  in  reference  [3]  was  to  orient 
three  of  the  gyro  spin  axes  orthogonal  with  sensitive  axes 
rotated  45°  from  coincidence  with  another  gyro's  spin  axis,  and 
with  the  fourth  gyro  spin  axis  bisecting  the  orthogonal  set. 

This  results  in  a rather  unsymmetric  condition,  where  perfor- 
mance ( FDI  and  navigation)  and  equations  to  be  solved  by  the 
computer  after  the  first  failure  depend  upon  which  gyro  failed 
first  - the  bisector  or  one  of  the  three  orthogonal  gyros.  A 
more  symmetric  arrangement  is  desirable  computationally  and  from 
packaging  considerations,  provided  that  the  computational  burden 
is  not  increased  significantly. 

An  obvious  symmetrical  choice  is  a tetrahedron  where  spin  axes 
are  directed  toward  the  four  vertexes  and  each  gyro  measurement 
plane  is  one  of  the  faces.  Spin  axes  are  thus  distributed  uni- 
formly in  space.  Another  form  of  the  tetrahedron  is  half  of  an 
octahedron.  With  this  configuration,  spin  axes  are  distributed 
uniformly  about  a hemisphere.  This  latter  orientation  is 
directly  analagous  to  the  dodecahedron  of  Draper  Labs,  reference 
[20).  In  that  case,  distributing  sensitive  axes  on  faces  of  a 
cube  (hexahedron)  results  in  pairs  of  coincident  (one  negative, 
one  positive)  sensitive  axes.  Since  the  computer  can  make  a 
sign  reversal,  the  desired  angular  distribution  is  not  achieved. 
Use  of  a dodecahedron  achieves  the  desired  distribution  without 
parallel  axes.  The  octahedron  has  a property  similar  to  the 
dodecahedron  in  that  pairs  of  the  eight  faces  are  parallel. 
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Therefore,  gyros  on  four  non-parallel  faces  of  the  octahedron 
are  evenly  distributed  in  space. 

Figure  4-18  illustrates  the  octahedron,  formed  from  equilateral 
triangles,  and  two  possible  selections  of  gyro  spin  vectors. 

The  octahedron  may  be  viewed  as  being  composed  of  two  pyramids 
with  the  square  bases  tied  together.  In  figure  4-18 (a)  the  four 
gyros  are  attached  to  only  one  pyramid.  In  figure  4-18 (b)  two 
of  the  gyros  are  moved  to  the  parallel  opposite  octahedral  faces. 
It  can  be  shown  that  this  latter  configuration  is  equivalent  to 
the  tetrahedron  where  the  angles  between  any  two  spin  vectors  are 
the  familiar  109.46°. 

In  terms  of  information  content,  these  two  geometries  are 
identical.  Certain  error  terms,  however,  behave  differently  in 
the  two  configurations.  In  the  tetrahedron,  the  net  angular 
velocity  of  the  4-gyro  array  is  zero  and  some  error  terms, 
notably  the  inertia  term,  cancel.  Since  the  system  must  work 
with  one  or  two  failed  gyros,  this  feature  cannot  be  fully 
exploited.  The  semi-octahedron  arrangement  has  certain  packaging 
advantages  so  that  it  is  preferred  over  the  tetrahedron. 

The  tetrahedron  could  be  achieved  by  reversing  the  spin  motors 
of  two  of  the  semi-octahedrally  mounted  gyros.  Many  of  the 
instrument  calibration  coefficients  such  as  bias,  scale  factor 
and  g-sensit ivity , would  not  precisely  reverse  polarity  with 
reversed  spin,  so  there  would  be  additional  calibration  costs. 
Again,  the  semi-octahedron  is  preferred  for  lowest  system  cost. 

The  symmetry  of  the  semi-octahedron  could  still  be  retained  with 
some  angle  other  than  109.46°  between  alternate  spin  vectors. 
Considering  spin  vectors  to  be  on  a cone,  this  would  be  equiva- 
lent to  varying  the  cone  angle  to  potentially  improve  some 
system  parameter.  Some  accuracy  degradation  would  be  expected 
since  the  amount  of  measurement  along  the  cone  axis  relative  to 
the  measurement  made  in  the  base  of  the  pyramid  would  change. 

Since  reliability  is  one  of  the  most  important  of  the  system 
parameters,  some  accuracy  degradation  might  be  acceptable  if 
improved  coverage  of  the  second  failure  could  be  achieved. 

Reducing  the  cone  angle  to  zero  makes  all  four  gyro  spin  axes 
coincident.  This  orientation  is  very  good  for  reliability 
(perfect  coverage  for  the  3-gyro  condition)  but  disastrous  for 
navigation  since  there  are  only  two  axes  of  information.  As 
soon  as  the  cone  angle  deviates  from  0°  sufficiently  to  obtain  a 
measurement  about  the  third  axis,  the  3-gyro  singularities  appear. 
A minor  improvement  in  coverage  could  be  achieved  by  reducing  the 
cone  angle  to  a very  small  angle,  say  30°.  For  this  condition, 
large  pitch  or  roll  rate  errors,  i.e.,  10°/sec,  can  be  detected 
and  isolated.  Due  to  the  improbability  of  such  a failure  mode, 
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coupled  with  packaging  and  computational  disadvantages,  this 
non-regular  tetrahedral  orientation  will  not  be  considered 
further . 

Another  trade-off  which  may  be  made  is  analagous  to  the  sinqle- 
degree-of-freedom  analysis  performed  by  Pe  jsa  in  reference  \_21 J . 

A gyro's  performance  is  improved  when  its  spin  axis  is  near 
vertical  due  to  elimination  of  errors  which  are  a function  of 
acceleration  or  gravity  normal  to  the  spin  vector.  Since  navi- 
gation performance  is  less  influenced  by  error  in  measurement 
of  angular  rate  about  the  local  vertical,  optimum  performance 
should  occur  with  cone  angles  smaller  than  the  ideal  octahedral 
109.46°  (assuming  the  cone  axis  is  vertical).  This  is  particu- 
larly true  for  flight  durations  of  about  an  hour  and  thus  is 
potentially  applicable  to  some  of  the  short-haul  VTOL  missions. 

The  application  under  consideration,  however,  includes  nearly 
continuous  position  updating  from  radio  aids.  The  important 
inertial  system  parameter  is  thus  rate-of-change  of  velocity 
error  since  this  establishes  how  well  velocity  may  be  calibrated 
from  position  updates  and  how  well  it  will  hold  this  calibration 
during  position  aid  outages.  Velocity  error  is  caused  by  a large 
number  of  error  sources  and  small  improvements  of  only  one  of 
these,  for  example  g-sensitive  bias,  will  not  have  a strong 
impact  on  net  performance.  Therefore,  the  instrument  skew  angle 
will  be  retained  in  the  nominal  octahedral  orientation.  A second- 
ary benefit  of  this  skew  angle  is  that  large  g-sensitive  drifts, 
one  of  the  normal  tuned  gimbal  gyro  failure  modes , can  be 
detected  and  isolated  before  flight  or  while  flying  straight  and 
level  rather  than  just  during  maneuvers. 

Once  spin  axis  skew  angles  have  been  selected,  sensitive  axis 
definition  is  largely  governed  by  avoidance  of  3-gyro  singulari- 
ties. Since  tuned  gimbal  gyros  are  sensitive  to  the  g-vector  in 
both  axes  simultaneously,  there  is  no  optimum  orientation  rela- 
tive to  gravity.  The  final  orientation  will  thus  be  selected  for 
ease  of  computation  and  packaging. 

Figure  4-18  shows  the  selected  relationship  between  the  earth's 
gravity  vector  and  the  gyro  spin  axes.  For  this  orientation, 
all  gyros  are  subject  to  the  same  portion  of  earth's  gravity. 

4.4.5  Accelerometer  Geometries 

If  a SDF  accelerometer  is  to  be  employed,  only  6 accelerometers 
would  be  required  for  fail-op/fail-op  capability.  They  could  be 
oriented  in  a dodecahedron  orientation  with  redundancy  manage- 
ment similar  to  that  performed,  for  example,  on  the  Draper  Labs 
SIRU.  The  channel  redundancy  approach  and  the  subsequent  low- 
cost-of-ownership  packaging  method  described  in  a subsequent 
section  of  this  report  are  lost,  however. 
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Since  the  proposed  packaging  arrangement  more  than  compensates 
for  the  added  accelerometer  costs  and  general  computational 
efficiency  is  improved,  8 accelerometer  axes  will  be  assumed, 
coincident  with  their  associated  gyro  sensitive  axis. 

4.4.6  Parity  Equations 

^*a^tty  equations  will  now  be  presented  for  the  semioctahedral 

axis  orientation.  Equations  are  based  on  gyro  measurements 
but  are  applicable  in  form  to  both  gyro  and  accelerometer  outputs. 

GYro  parity  equations  and  axis  definitions  are  given  in  figure 
4-19.  These  equations  are  derived  in  Appendix  B of  this  report. 
Gyro  number  is  designated  by  subscript  i or  j.  The  gyro  spin 
vector  is  identified  by  the  letter  and  subscripts  x.  and  y. 

define  the  gyro  sensitive  axes. 

A parity  equation,  T^^,  represents  a direct  comparison  between 

the  angular  rate  measured  by  the  i and  j gyros  about  some  common 
test  direction  The  test  direction  is  along  the  intersection 

of  the  measurement  planes  of  the  two  gyros.  These  components 
may  be  directly  compared  to  remove  vehicle  rate  and  thus  expose 
any  gyro  error  rates. 

Another  form  of  the  parity  equations  was  investigated,  namely 
comparison  of  a gyro  rate  to  the  least-squares  solution  of  the 
other  gyro  measurements  projected  onto  the  plane  of  that  gyro. 

The  benefits  obtained  were  not  found  to  be  sufficiently  great 
compared  to  simple  intersection  comparisons  to  warrant  the 
added  computational  complexity. 

A simple  method  of  isolating  a fault  to  the  failed  gyro  is  to 
integrate  (approximately)  each  parity  equation  and  compare  the 
output  against  some  detection  threshold,  60,  as  shown  in  figure 
Logic  is  then  employed  in  the  computer  such  that  if  two 
or  more  equations  involving  a gyro  exceed  the  threshold,  that 
classified  as  failed  and  switched  out  of  the  output 
computation.  Other  detection,  isolation  and  switching  options 
are  discussed  in  the  next  subsections  of  this  report. 

A physical  interpretation  of  the  parity  equations  for  a tetra- 
hedron may  be  achieved  by  means  of  figure  4-20.  The  faces  of 
the  tetrahedron,  #1,  #2,  #3,  and  #4,  represent  the  four  TDF  gyro 
measurement  planes.  A parity  equation  is  formed  at  each  edge  of 
the  tetrahedron,  the  intersection  of  two  gyro  measurement  planes. 
For  example,  u>^A  is  the  rate  measured  by  gyro  #1  in  the  A 

direction  and  w3a  is  the  rate  measured  by  gyro  #3  in  the  A 

direction.  Since  the  two  measurements  are  of  the  same  quantity, 
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namely  the  component  of  the  total  vehicle  angular  rate,  w VEHICLE ' 

in  the  A direction,  the  two  measurements  may  be  differenced  to 
determine  measurement  error. 

Consider  a vector  measurement  error  made  by  gyro  #1  in  a 
direction  perpendicular  to  edge  B.  The  component  of  rate 

measured  by  gyro  #1  will  therefore  not  contain  any  error  - it 
would  be  a perfect  measurement  of  the  component  of  ^vehicle 

the  B direction.  Assuming  no  errors  in  gyro  #2,  the  B edge 
parity  equation  will  thus  be  zero.  The  A and  C edge  parity 
equations  will  expose  the  error,  however,  and  thus  fault  isola- 
tion can  be  achieved. 

If  gyro  #4  had  previously  failed,  the  C,  D and  F edge  parity 
equations  are  lost.  For  the  gyro  #1  error  rate  perpendicular  to 
edge  B,  only  the  A edge  parity  equation  exceeds  its  threshold. 
This  condition  could  also  be  caused  by  a gyro  #3  error  rate 
perpendicular  to  edge  E.  Therefore,  this  vector  direction  of 
gyro  error  is  a fault  isolation  singularity  of  the  same  type 
described  for  three  orthogonal  gyros.  Note  that  no  reference 
was  made  to  the  particular  tetrahedron  angles.  This  condition 
applies  to  any  non-colinear  orientation  of  three  gyros. 

The  preceding  is  not  a general  proof  of  the  existence  of  the 
isolation  singularities  occurring  with  3 TDF  gyros,  however, 
since  parity  equations  may  take  forms  other  than  the  tetrahedron 
edge  comparisons.  A general  proof  is  obtained  with  the  aid  of 
figure  4-21. 

Consider  three  gyros,  the  sensitive  axes  of  each  represented  by 
a plane  surface.  The  orientation  of  the  two  gyro  input  axes  in 
this  plane  is  immaterial  since  measurements  made  in  one  orien- 
tation can  be  changed  to  another  with  a simple  coordinate  trans- 
formation about  the  spin  axis. 

Consider  next  a vehicle  angular  rate  u3  along  the  spin  axis  of 
gyro  #1  of  figure  4-21.  The  rates  sensed  by  each  gyro  are  the 
projections  of  Zj  onto  each  measurement  plan,  where  = 0. 

Given  the  gyro  measurements  and  , one  can  reconstruct  an 

estimate  of  w along  the  intersection  of  two  planes  - one  plane 
is  normal  to  gyro  measurement  plane  #2  and  along  , the  other 

plane  is  normal  to  gyro  measurement  plane  #3  and  along  u>,.  This 

reconstructed  w is  also  consistent  with  = 0. 

If  gyro  #3  has  an  error  Auj^  along  the  direction  of  the  error 

in  the  reconstructed  , XU,  is  along  the  direction  of  w.  The 
same  error  could  have  been  caused  by  an  error  in  gyro  #2  along 
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Figure  4-21.  Illustration  of  3-Gyro  Isolation  Singularity 
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the  direction  of  ij^.  Gyro  #1  cannot  contribute  information  in 

determining  whether  ki  was  caused  by  gyro  #1  or  gyro  #2  since 
is  normal  to  its  measurement  plane.  Therefore,  isolation 
singularities  occur  in  each  gyro  measurement  plane  for  gyro 
drift  errors  along  the  projections  of  the  other  gyro  spin  axes 
onto  that  plane. 

Isolation  error  may  again  be  plotted  vs.  gyro  error  direction, 
figure  4-22,  where  the  origin  of  the  abscissa  is  the  perpendicu- 
lar to  edge  B of  the  tetrahedron.  This  plot  is  directly  compar- 
able to  figure  4-17,  for  orthogonal  gyros.  The  location  of 
singularities  has  changed  to  account  for  tetrahedral  geometry. 

If  the  detection  level  4>  is  set  at  the  noise  level  of  the  gyro, 

o 

the  curve  of  figure  4-22  indicates  that  there  is  an  amplification 
of  this  basic  noise  level  as  a function  of  gyro  drift  direction 
due  to  geometry,  analagous  to  the  geometrical  amplification  of 
errors  in  a LORAN  C net.  If  the  allowable  isolation  error  is 
very  large  (for  example,  flight  control  requirements  may  tolerate 
l°/sec.  error  compared  to  0.5°/hr  or  less  for  navigation  needs) 
gyro  failure  modes  having  drift  directions  very  close  to  the 
singular  direction  can  still  be  isolated  since  the  noise  level 
of  inertial-grade  gyros  is  so  low.  Therefore,  the  effective 
angular  width  of  the  singularities  decreases  compared  with  360° , 
and  thus  the  probability  of  non-isolation  decreases.  Flight 
control  reliability,  then,  will  be  much  higher  than  navigation 
reliability.  This  relationship  will  be  expanded  upon  in  later 
sections  of  this  report. 

Parity  equations  for  the  semioctahedron  form  of  the  tetrahedron, 
figure  4-19,  are  essentially  the  same  as  for  a regular  tetra- 
hedron. The  parity  equations  are  again  formed  at  the  edges  of 
the  polyhedron.  Note  that  the  intersection  between  gyros  i and 
k is  parallel  to  the  upper  and  lower  horizontal  edges.  Each 
face  of  the  octahedron  is  still  composed  of  an  equilateral 
triangle,  so  the  behavior  of  parity  equations  is  identical  to  the 
standard  tetrahedron.  The  selection  of  gyro  sensitive  axes  has 
been  made  to  avoid  coincidence  with  any  possible  singularity. 

It  is  interesting  to  review  the  reduced  cone-angle  trade-off  of 
paragraph  4.4.4  in  light  of  the  above  interpretation.  Figure 
4-23  illustrates  a flattened  semioctahedron.  Faces  of  the  octa- 
hedron now  deviate  from  equilateral  triangles,  approaching  right 
isosceles  triangles.  Clearly  navigation  errors  will  deteriorate 
due  to  geometrical  dilution  of  measurements  along  an  axis  out  of 
the  peak  of  the  pyramid.  If  this  axis  is  made  the  aircraft  yaw 
axis,  net  navigation  performance  might  be  acceptable. 
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Parity  equations  for  this  geometry  would  be  very  similar  to 
those  described  for  the  regular  octahedron.  3-gyro  singularities 
appear  as  before  except  at  different  angles.  Considering  gyro  i 
in  figure  4-23, singularities  are  perpendicular  to  edges  A and  B 
if  gyro  k has  failed,  and  perpendicular  to  edges  A and  C if  gyro 
j has  failed. 

The  only  apparent  benefit  from  this  geometry  is  that  an  improved 
reasonableness  test  could  be  performed  during  the  remote  possi- 
bility of  a large  gyro  failure  along  a singular  direction  during 
3-gyro  operation.  Consider  a prior  k-gyro  failure  and  an  i-gyro 
error  in  a direction  parallel  to  B.  The  error  shows  up  in  the  B 
edge  test  with  gyro  j,  but  not  in  the  A edge  test  with  gyro  1. 
Therefore,  the  error  is  detected  but  not  isolated  to  either  the 
i or  j gyro.  However,  because  the  B and  F edges  are  nearly 
col inear,  a crude  comparison  can  be  made  between  the  i and  1 
gyros,  limited  by  how  much  aircraft  yaw  rate  can  be  coupled 
through  the  angle  between  the  B and  F edges.  If  the  measurement 
difference  is  greater  than  the  maximum  possible  coupled  yaw  rate, 
fault  isolation  between  i and  j gyros  can  be  made. 

As  described  in  paragraph  4.4.4,  the  disadvantages  in  computa- 
tional efficiency  and  packaging  incurred  for  a reduced  cone  angle 
outweigh  the  minor  fault  isolation  improvement  achieved  for  a 
remote  failure  mode.  Therefore  the  regular  octahedron  skew 
angle  will  be  retained. 

4.4.7  Error  Detection  and  Isolation  Methods 

Since  the  outputs  from  the  gyros  and  accelerometers  are  incre- 
mental in  nature,  angle  and  velocity  increments,  respectively, 
determination  of  angular  rate  and  linear  acceleration  would 
require  differentiation  of  these  sensed  values  in  the  computer. 
This  processing  method  is  impractical  due  to  amplification  of 
noise  and  data  quantization  which  would  lead  to  a high  false 
alarm  rate  in  the  redundancy  management. 

Integration  of  parity  equations  produces  the  desired  smoothing. 
Error  detection  would  then  be  on  the  basis  of  angle  and  velocity. 
However,  accelerometers  and  gyros  contain  a variety  of  normal- 
mode errors,  including  bias.  Integration  of  these  normal  bias 
errors  over  a long  period  of  time  tends  to  obscure  failure-error 
buildups.  A simple  lag  filter  washes  out  the  bias  errors  while 
acting  as  an  integrator  over  short  periods  of  time.  Use  of  a 
simple,  low-pass  digital  filter  was  used  on  SIRU,  [20] , [23] , as 

part  of  the  TSE  (total  squared  error)  FDI  (failure  detection  and 
isolation)  and  is  also  selected  for  this  study. 

A simple  means  of  processing  the  "integrated"  parity  equations  is 
to  compare  each  individually  against  a predetermined  threshold. 
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When  thresholds  are  exceeded,  a logic  truth  table  such  as  that 
shown  in  paragraph  4.4.3  is  then  used  to  determine  the  failed 
gyro. 

Other  methods  involving  a combination  of  parity  equations  have 
been  described  in  the  literature  for  SDF  gyros,  such  as  the  TSE 
[23] , Minimax  [22] , Maximum  Likelihood  [25] , Kalman-Bucy  and 
others  [26]  . These  cannot  be  directly  employed  for  TDF  gyros 
except  conceptually. 

In  order  to  view  drawbacks  of  the  simple  table  look-up  method, 
consider  again  figure  4-22.  This  curve  may  be  considered  as  a 
boundary  or  threshold  for  error  detection  for  a 3-gyro  condition, 
using  uncombined  parity  equations.  If  <j>0  is  taken  to  be  the 
noise  level  of  the  gyro,  the  error  detection  limit  must  be  set 
well  enough  above  the  noise  to  avoid  false  alarms  and  missed 
alarms.  (NOTE:  The  curve  of  figure  4-22  assumes  that  only  one 

gyro  has  an  error  and  is  thus  incomplete.  It  is  used  for  illus- 
tration only.)  Figure  4-24a  is  a polar  plot  of  figure  4-22. 

A 1/sin  function  is  simply  a straight  line  on  a polar  plot. 

Direct  use  of  parity  equations  in  the  4-gyro  case,  with  fault 
detection  and  isolation  based  on  two  equations  exceeding  detec- 
tion limits,  is  equivalent  to  processing  gyro  data  using  three 
gyros  at  a time.  Thus  the  detection  threshold  versus  gyro  error 
direction  for  the  full  four-gyro  set  may  be  derived  by  super- 
position of  three  curves  of  the  form  of  figure  4-24a,  each 
rotated  by  60°  from  the  rest.  This  superposition  process  is 
illustrated  in  figure  4- 24b. 

The  inner  portion  of  each  of  the  plots  of  figure  4-24b  represents 
the  parity  equation  pair  which  produces  the  smallest  isolation 
error  for  a given  gyro  drift  and  is  thus  the  pair  with  which  the 
error  is  first  detected.  A composite  of  the  isolation  error 
which  considers  this  isolation  logic  is  shown  in  figure  4-24c. 

For  both  the  four  and  three  gyro  conditions,  it  is  clear  that  the 
isolation  threshold  is  not  constant  as  a function  of  the  angle 
of  the  gyro  drift.  If  the  threshold  is  set  at  the  largest  value 
allowed  by  system  requirements  and  this  is  very  close  to  the 
point  of  the  star  for  four  gyros,  system  errors  smaller  than 
this  value  produce  a failure  indication  a significant  portion  of 
time.  These  failure  indications  might  still  be  arbitrarily 
classified  as  "failure"  conditions  even  though  real  errors  are 
smaller  than  the  system  error  limit,  so  would  not  contribute  to 
false  alarm  rate. 

Real  false  alarm  rate  could  be  reduced,  however,  by  processing 
parity  equations  to  achieve  a more  constant  detection  level  vs 
failure  angle  and  make  full  use  of  the  information  contained  in 
these  equations.  Note  that  at  the  points  of  the  star  of  figure 
4-24c,  all  three  parity  equations  exceed  the  threshold  but  in 
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reality  only  two  are  being  used.  Better  processing  could 
achieve  either  tighter  detection  limits  or  reduced  false  alarm/ 
missed  alarm  rates. 

When  large  gyro  errors  occur,  speed  of  detection  is  important  to 
avoid  transients  in  the  aircraft  flight  control  system.  Due  to 
the  simplicity  of  the  table  look-up  method  which  operates  on 
uncombined  parity  equations,  a high  computer  iteration  rate  can 
be  used  for  this  test.  Since  a combination  of  parity  equations 
is  primarily  applicable  to  detection  and  isolation  of  small 
errors  which  takes  a long  time  anyway,  such  processing  can  be 
performed  at  a low  rate  with  little  impact  on  computer  duty 
cycle.  Thus,  inclusion  of  both  methods  is  desirable.  The  deri- 
vation of  parity  equation  combinations  is  given  in  paragraph  5.3 
of  this  report. 

Methods  have  been  proposed  in  the  literature  [21]  for  classifying 
a gyro  drift  as  either  a step  or  ramp  function  and  then  applying 
a compensation  to  the  faulty  instrument  to  bring  it  back  to  a 
useful  state.  This  approach  may  have  application  to  space 
systems  where  vehicle  maneuvers  are  limited.  In  an  aircraft 
system,  however,  normal  turns  produce  time-varying  gyro  errors 
since  scale-factor,  g-sensitivity , and  axis  alignment  error 
coefficients  are  exercised.  Therefore,  this  approach  is  felt  to 
be  inapplicable  to  the  aircraft  redundant  strapdown  system. 

Significant  errors  occur  during  a turn  due  to  deviation  of  each 
gyro  scale  factor  from  its  nominal  value.  For  a 3° /sec  turn  and 
100  ppm  scale  factor  error,  there  is  a gyro  drift  error  of  l°/hr 
for  the  duration  of  the  turn.  A 180°  turn  lasts  60  seconds  and 
results  in  an  error  buildup  of  1 arc  minute  if  the  turn  rate  is 
about  the  gyro  sensitive  axis.  Considering  that  100  ppm  is  a 
typical  1-sigma  value  and  near-continuous  turning  may  need  to  be 
provided  for,  scale  factor  effects  need  to  be  either  accommodated 
or  compensated. 

The  study  program  covered  by  this  report  includes  only  a brief 
examination  of  scale  factor  compensation  in  paragraph  5.3. 
Insufficient  time  was  available  for  a thorough  analysis.  This 
appears  to  be  worth  further  study,  however,  to  allow  a reduction 
of  gyro  drift  detection  levels.  The  effects  of  other  maneuver- 
dependent  errors  must  also  be  considered  in  determining  the 
effectiveness  of  scale-factor  compensation,  but  due  to  the  mag- 
nitude of  the  scale  factor  effect,  compensation  appears  a promis- 
ing technique  for  improving  error  detection  and  isolation 
sensitivity. 

There  is  a finite  probability  that  two  gyro  failures  can  occur 
simultaneously.  This  is  particularly  true  for  small  failures 
since  several  minutes  of  time  may  be  needed  to  detect  and  isolate 
a given  drift.  Provisions  should  be  included  in  FDI  algorithms 
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for  multiple  failure  modes  where  practical.  Excessive 
computation  should  be  avoided  due  to  the  low  probability  of 
occurrence.  There  exists  a dual  failure  mode  condition  where 
the  parity  equations  remain  satisfied  (a  failure  is  not  detec- 
ted). For  this  situation  to  occur  the  two  simultaneous  failures 
need  to  be  equal  in  amplitude  and  each  be  in  a specific  vector 
direction.  The  joint  probability  that  these  events  all  occur 
simultaneously  is  considerably  less  than  the  total  system 
failure  probability  and  is  estimated  in  paragraph  5.3. 

4.4.8  Switching  Methods 

Once  an  error  has  been  detected  and  isolated,  further  action  is 
required  to  prevent  the  erroneous  information  from  affecting 
system  outputs.  The  most  obvious  method  is  to  simply  switch  out 
the  gyro  from  all  computations.  Consideration  should  be  given 
to  minimizing  switching  transients  in  flight  control  functions, 
however.  Weighting  schemes  such  as  described  in  [30]  may  need 
to  be  considered  if  transients  are  troublesome. 

Vehicle  angular  rate  and  linear  acceleration,  in  body  coordi- 
nates, are  required  as  outputs.  Computer  switching  from 
instrument  to  instrument  could  cause  very  small  transients  in 
these  outputs.  Error  detection  levels,  however,  are  set  orders 
of  magnitude  smaller  than  the  normal  accuracy  required  of  these 
outputs.  Therefore,  switching  transients  are  insignificant. 

Attitude,  heading,  velocity,  and  position  outputs  are  one  or 
more  integrations  away  from  the  instruments.  Switching  of 
instruments  thus  does  not  cause  transients  in  these  outputs. 

The  only  way  in  which  transients  could  occur  is  if  switching  is 
performed  directly  on  these  functions  or  during  reinitialization 
modes  during  error  recovery.  This  is  discussed  in  paragraph 
4.5.1  relative  to  the  software  mechanization.  Weighted  com- 
binations of  instrument  outputs  to  eliminate  transients  therefore 
is  not  needed. 

A secondary  purpose  of  combining  instrument  outputs  in  a weighted 
manner  is  to  reduce  system  error.  Monitoring  of  parity  equations 
during  normal  operation  yields  some  information  regarding 
relative  performance  of  instruments.  Since  parity  equations  are 
strongly  influenced  by  noise  during  these  conditions,  weighting 
factors  must  be  determined  from  error  probabilities.  This  tech- 
nique is  of  value  during  very  soft  failures,  near  the  instrument 
noise  characteristics,  and  during  soft  failure  modes  during 
3-gyro  operation.  Simplified  methods  should  be  used  in  order  to 
limit  the  computer  penalties  since  system  performance  benefits 
derived  from  this  mechanization  are  subtle. 
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Once  a gyro  has  been  classified  as  failed,  it  should  continue 
heing  monitored , but  not  be  involved  in  output  computations.  It 
could  then  be  reinstated  into  the  computation  if  required.  Thus 
false  alarms  due  to  noise  are  less  important  since  use  of  the 
gyro  is  not  lost  for  the  full  duration  of  the  flight.  Also,  a 
soft-failed  gyro  may  still  be  good  enough  to  resolve  the  3-gyro 
isolation  ambiguity  in  the  rare  event  that  it  occurs.  Further- 
more, use  of  a marginal  gyro  for  monitoring  and  backup  following 
a second  failure  is  better  than  having  none  at  all. 

If  a gyro  failure  having  a constant  direction  is  detected, 
should  the  entire  gyro  be  switched  out  of  the  computation,  or 
should  the  data  normal  to  the  failure  direction  be  retained  ? 

A special  case  of  this  question  is  whether  or  not  it  is  neces- 
sary to  isolate  failures  to  a specific  instrument  or  is  it 
sufficient  to  merely  eliminate  the  bad  data.  This  is  of  particu- 
lar interest  when  a failure  is  along  one  of  the  3-gyro  isolation 
singularities . 

Figure  4-25  may  be  used  to  illustrate  this  procedure.  Consider 
gyro  #4  to  have  previously  failed,  thus  leaving  the  three  edge 
parity  equations  A,  B,  and  C.  Assume  that  the  A edge  parity 
equation  is  indicating  a failure  but  that  B and  C are  zero.  The 
failure  must  be  either  gyro  #1  or  gyro  #2  for  this  condition  to 
be  true.  Therefore  gyro  #3  is  good.  The  two  possible  error 
vectors  which  could  cause  this  condition  are  perpendicular  to 
edge  B for  gyro  #1  or  perpendicular  to  edge  C for  gyro  #2,  as 
shown.  The  gyro  measurements  perpendicular  to  these  possible 
error  vectors  in  the  measurement  planes  are  parallel  to  gyro  $3. 
Thus  an  unambiguous  measurement  normal  to  the  known  good  gyro  is 
unavailable. 

There  are  some  gyro  failure  modes  where  one  axis  exhibits  poor 
performance  but  the  other  axis  is  still  good.  An  electronics 
scale  factor  shift  is  an  example.  This  is  a sufficiently  rare 
condition  that  special  software  provisions  for  partial  gyro  data 
retention  do  not  appear  warranted.  Therefore,  when  a gyro 
exhibits  a failure  drift,  it  will  be  completely  switched  out  of 
the  output  computations. 

Since  the  two  accelerometer  axes  are  implemented  with  two  inde- 
pendent instruments,  failure  modes  are  also  independent  except 
when  it  involves  some  common  function  such  as  the  power  supply. 

A very  minor  increase  in  system  reliability  could  be  obtained 
by  switching  out  one  accelerometer  when  a failure  is  indicated. 
On  a preliminary  basis,  however,  both  axes  are  switched  for 
software  simplicity. 
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4.4.9  Failure  Coverage 

Determination  of  failure  coverage  depends  strongly  upon 
definition  of  a failure.  In  other  words,  what  output  errors 
(1  sigma,  3 sigma,  6 sigma  ) result  in  a failure  condition  which 
jeopardizes  flight  safety  or  proper  completion  of  the  flight, 
and  how  long  may  the  errors  be  present  (is  time-rmsing  appli- 
cable) ? The  instrument  errors  which  can  cause  this  condition 
must  then  be  derived. 

Derivation  of  the  definition  of  an  instrument  failure  is  compli- 
cated by  the  fact  that  system  performance  requirements  include 
updates  from  an  external  radio  aid  using  some  form  of  combina- 
tional filter.  Gyro  drift  requirements  are  very  much  a function 
of  the  accuracy  of  the  radio  aid  and  the  sophistication  of  the 
filter . 

In  a redundant  system,  component  error  budgeting  is  influenced 
by  error  detection  and  isolation  requirements  relative  to  the 
allowable  system  errors  just  prior  to  switching-out  a "failed" 
component.  Instrument  tolerances  may  need  to  be  tighter  for  a 
redundant  system  than  for  a single-string  system  since  failure 
detection  limits  must  be  set  much  higher  than  normal  component 
tolerances  (e.g.,  5 sigma)  to  limit  false  alarms.  This  state- 
ment is  somewhat  contrary  to  the  normally  accepted  fact  that 
system  accuracy  is  improved  slightly  over  a non-redundant  system 
by  averaging  the  redundant  data.  This  accuracy  improvement  only 
applies  to  the  zero-failure  condition,  however.  Since  system 
accuracy  must  be  undegraded  after  two  failures,  improved  zero- 
failure  performance  is  of  minor  overall  benefit. 

Use  of  probabilistic  weighting  coefficients  derived  from  parity 
equations,  parity  equation  combination  processing,  and  scale 
factor  compensation  described  in  paragraphs  4.4.7  and  4.4.8  can 
all  tend  to  offset  the  degradation  of  system  performance  just 
prior  to  switching-out  a failed  component.  Thus  these  techniques 
are  very  useful  in  reducing  the  impact  of  redundancy  management 
on  the  instrument  error  budget  while  retaining  low  false  alarm 
rate  and  high  failure  coverage. 

A full  analysis  considering  the  interaction  between  system 
performance,  redundancy  management  algorithms  and  component 
error  budgets,  is  beyond  the  scope  of  this  preliminary  design 
report.  The  error  budget  is  determined  essentially  from  single- 
string requirements  (with  a simple  filter  and  some  assumed  radio 
noise  model).  Error  detection  and  isolation  thresholds  are  set 
to  be  large  enough  to  avoid  high  false  and  missed  alarm  rates, 
with  little  consideration  of  pre-alarm  performance  transients. 
Means  of  recovery  from  these  small  transients  to  reduce  their 
time  duration,  however,  will  be  included  in  the  computer 
mechanization. 
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The  coverage  of  the  first  failure  will  be  essentially  unity 
since  it  will  be  designed  to  be  so.  All  coordinates  have  suf- 
ficient measurement  information  for  completely  unambiguous 
"failure"  detection  and  isolation.  The  coverage  of  the  second 
failure  must  consider  the  effects  of  the  3-gyro  isolation  singu- 
larity coupled  with  the  full  spectrum  of  gyro  failure  modes. 

If  a large  number  of  redundant  strapdown  systems  were  operated 
for  a long  period  of  time,  there  would  be  some  distribution  of 
the  aggregate  failures  between  hard  failures,  detectable  by 
simple  self-test,  and  soft  failures,  those  needing  redundancy 
management.  The  soft  failures  would  also  be  distributed  among 
a variety  of  failure  modes,  and  only  a portion  of  these  would  be 
subject  to  the  3-gyro  isolation  singularity.  Table  4-2  shows  a 
hypothetical  distribution  of  system  failures.  While  not  based 
on  real  data,  it  is  useful  in  approximating  coverage  of  the 
second  failure. 


TABLE  4-2.  HYPOTHETICAL  SYSTEM  FAILURE  DISTRIBUTION 


Nav. 

Accuracy 

(%) 

Flight 

Control 

Accuracy 

(%) 

Hard  Failures 

90 

95 

Soft  Failures 

10 

5 

Electronics 

2 

Accelerometer 

2 

1 

Gyro 

6 

4 

Variable  Direction 

4 

2 

Constant  Direction 

2 

2 

Non-Singular 

1.5 

1.98 

Singular 

0.5 

0.02 
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Self-test  is  commonly  felt  to  be  effective  for  90-95%  of  failure 
modes.  There  are  many  more  failure  modes  producing  small  accu- 
racy degradation  of  navigation  variables  than  flight  control 
variables  where  a few  degrees  per  second  may  be  acceptable. 

Thus  it  is  assumed  that  the  split  between  hard  and  soft  failures 
is  90/10  for  navigation  performance  and  95/5  for  flight  control. 
The  slightly  better  MTBF  for  flight  control  channel  reliability 
will  be  ignored. 

Soft  failures  are  distributed  between  gyros,  accelerometers,  and 
the  remaining  electronics.  The  gyros  are  assigned  a major  share 
since  they  are  generally  of  more  complex  design.  The  gyro 
failures  are  then  distributed  between  those  whose  vector  direc- 
tion is  constant  and  those  whose  vector  direction  varies  with 
time.  Since  a failure  mode  generally  produces  an  uncontrolled 
condition  and  since  many  failures  are  flight -path  dependent,  it 
is  assumed  that  most  failures  fall  into  this  latter  category. 

If  the  gyro  failure  vector  direction  varies,  the  failure  is  not 
subject  to  the  3-gyro  isolation  singularity. 

Of  the  remaining  constant-direction  failures,  only  a portion  of 
them  fall  into  the  isolation  singularity  bands.  First,  there  is 
some  probability  density  distribution  for  gyros  as  a function  of 
failure  angle.  Figure  4-26  shows  the  general  form  such  a dis- 
tribution might  take,  in  polar  coordinates.  Again,  real  world 
data  is  unavailable  for  an  accurate  plot. 

Peaks  are  expected  to  occur  in  the  failure  probability  distri- 
bution in  the  vicinity  of  the  gyro  input  axes  since  there  are  a 
number  of  components  in  the  electronics  and  gyro  specifically 
related  to  axes.  The  integral  of  probability  density  over  360°, 
excluding  the  vicinity  of  input  axes,  may  be  called  the  proba- 
bility of  a dual  axis  failure.  In  general,  the  probability  of  a 
dual  axis  failure  is  expected  to  be  higher  than  the  probability 
of  an  input  axis  failure  since  there  is  a strong  interaction 
between  axes  of  a TDF  gyro. 

The  probability  of  a failure  along  some  arbitrary  direction,  + 

within  a narrow  angular  band,  however,  is  expected  to  be 

lower  than  the  probability  of  failure  along  an  input  axis,  since 
dual-axis  failure  modes  are  distributed  among  a wide  number  of 
possible  directions.  This  rationale  leads  to  the  conclusion  that 
gyro  input  axes  should  not  be  coincident  with  any  possible 
3-gyro  isolation  singular  direction.  The  exact  form  of  the 
probability  density  distribution  is  unknown.  It  is  assumed 
uniform  between  input  axes  for  simplicity. 

The  effective  angular  width  of  the  3-gyro  isolation  singularity 
is  smaller  for  large  allowable  errors  (flight  control)  than  for 


117 


403314 


small  allowable  errors.  This  may  be  seen  with  the  aid  of  figure 
4-27,  a repeat  of  the  noise  boundary  curve  of  figure  4- 24a. 

When  error  detection  limits  are  set  very  close  to  the  system 
noise  level,  as  would  be  required  to  bound  navigation  errors 
(position/velocity),  the  effective  isolation  singularity  is 
fairly  broad,  as  shown  in  figure  4-27a.  For  large  allowable 
errors,  orders  of  magnitude  larger  than  the  normal  instrument 
noise  level,  the  effective  singularity  becomes  quite  narrow,  as 
shown  in  figure  4- 27b. 

When  this  view  of  effective  singularity  width  is  coupled  with 
the  gyro  failure  probability  density  distribution  previously 
described,  one  can  see  that  the  percentage  of  failures  occurring 
within  the  isolation  singularities  reduces  considerably  for 
large  allowable  errors,  thus  increasing  coverage.  Hypothetical 
distributions  are  shown  in  table  4-2.  No  attempt  is  made  to 
rigorously  quantify  these  functions  since  net  probability  is 
well  within  LaRC  requirements. 

It  may  be  noted  that  some  additional  external  data  would  be 
useful  in  resolving  the  rare  occurrence  of  the  isolation  ambi- 
guity. Since  radio  aids  are  planned  in  the  LaRC  scenario,  they 
could  be  applied  toward  further  improvement  in  system  relia- 
bility. The  computer  mechanization  will  be  directed  toward 
allowing  this  to  be  done,  however  its  application  will  not  be 
used  in  the  reliability  calculation. 

There  is  some  variation  of  coverage  with  time  since  many  of  the 
terms  of  the  instrument  error  models  are  a function  of  flight 
dynamics.  This  consideration  is  of  particular  concern  during 
ground  alignment.  System  errors  due  to  gyro  scale  factor  and 
vibration- dependent  errors  are  much  smaller  at  this  time  than 
when  the  aircraft  is  stationary.  On  the  other  hand,  failure 
tolerances  on  the  parity  equations  can  be  tightened  up  during 
this  condition  for  better  detectability  of  static  errors.  Since 
inertial  instruments  are  of  such  high  quality  compared  to 
flight-control  requirements,  errors  which  would  directly  affect 
flight  safety  can  be  adequately  detected  on  the  ground.  The 
remaining,  navigation  degradation  errors  would  generally  be 
detected  during  lift-off. 

It  is  highly  desirable  to  detect  errors  of  this  type  as  early  as 
possible  before  takeoff  to  allow  maintenance  action.  Provision 
for  accentuating  these  errors  by  hardware  means  shortly  after 
power  is  applied  to  the  system  should  be  investigated  during  the 
system  design  phase. 
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4.5  Software  Trade-offs 

4.5.1  Redundancy  Management  Software  Design 

Consideration  has  been  given  to  a classical  approach  where  all 
instrument  data  are  combined  in  each  computer  prior  to  output 
processing.  The  computer  mechanization  which  has  been  selected, 
however,  uses  instruments  in  pairs  in  order  to  achieve  better 
overall  redundancy  management,  including  radio  aid  contributions, 
and  to  allow  recovery  from  system  error  build-ups  during  the 
isolation  process.  This  includes  recovery  from  isolation  errors 
which  may  be  amplified  by  the  3-gyro  isolation  singularities. 

The  method  generally  proposed  for  processing  of  redundant  instru- 
ment data  following  redundancy  management,  is  to  combine  the 
redundant  measurements  in  a least-squares  fashion  prior  to  use. 
Net  accuracy  is  thus  better  than  a single-string  configuration. 
Equations  for  combining  gyro  or  accelerometer  data  when  oriented 
in  a tetrahedral  or  octahedral  geometry  have  been  derived  for  4, 

3,  and  2 TDF  units,  and  are  presented  in  Appendix  F. 

With  this  approach,  each  of  the  four  computers  is  solving  the 
same  problem.  This  is  then  consistent  with  fault-tolerant 
computer  methods.  Each  processor  solves  the  same  problem  in 
approximate  synchronization,  each  output  should  thus  be  identi- 
cal, and  outputs  can  be  compared  bit-by-bit  with  simple  hard- 
ware  devices  for  computer  fault  detection  and  isolation. 

Computer  problems  can  thus  be  easily  isolated. 

A major  drawback  of  using  combined  instrument  data  in  the  output 
solutions,  is  that  a degraded  instrument  which  escapes  detection 
or  isolation  in  parity  equation  processing  is  combined  with  good 
instruments . The  opportunity  of  resolving  the  occasional  3-gyro 
isolation  singularity  or  detecting  performance  degradation  less 
than  INS  thresholds  with  radio  aid  data  is  thus  lost,  or  at  least 
considerably  complicated.  INS  degradation  would  be  detected 
when  compared  against  radio  data,  but  determination  of  which 
unit  is  marginal  to  initiate  maintenance  action  may  be  extremely 
difficult . 

In  the  assumed  system  mechanization,  each  computer  output  is 
sent  to  other  avionics  elements  individually.  This  implies  that 
some  other  avionics  system  performs  a comparison  between  INS 
outputs  and  radio  aid  data.  Since  this  involves  an  arithmetic 
process,  this  further  means  that  the  voting  between  the  four 
redundant  strapdown  outputs  must  utilize  arithmetic  rather  than 
simple  bit-by-bit  comparisons. 

In  other  avionics  implementations,  voted  or  weighted  combinations 
of  redundant  data  could  be  derived  in  a using  device  such  as  an 
actuator  or  display  using  modern  microprocessor  technology. 
Therefore,  there  is  no  firm  requirement  for  compatibility  with 
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simple  bit-by-bit  voters.  Such  compatibility  could  be  achieved, 
however,  with  a final  voting/combining  subroutine  in  each  redun- 
dant INS  computer.  Since  each  computer  iteration  is  synchro- 
nized, all  computer  outputs  can  be  made  identical  in  software 
prior  to  transmission  to  external  voters.  For  the  purposes  of 
this  study,  however,  it  is  assumed  that  external  systems  contain 
arithmetic  capability. 

Figure  4-28  shows  a preferred  4-computer  implementation.  Each 
computer  accepts  data  from  one  TDF  gyro  and  two  accelerometers. 
Compensation  of  various  instrument  parameters  is  then  performed, 
including  transformation  from  the  skewed  instrument  coordinate 
system  into  aircraft  body  axes.  Each  computer  solves  this  com- 
pensation and  transformation  for  the  instruments  of  only  one 
channel.  Since  these  are  high  rate,  time-consuming  computations, 
net  computer  speed  requirements  are  significantly  reduced  from 
an  equal-computer  approach. 

At  this  point,  each  computer  receives  corrected  gyro  and 
accelerometer  data  from  the  other  three  computers,  solves  parity 
equations  and  performs  associated  FBI  processing.  There  would 
be  only  minor  savings  in  splitting  parity  equations  and  pro- 
cessing between  the  four  computers  since  they  are  not  complex. 
Design  equations  are  then  solved  which  determine  a least  squares 
solution  of  two  TDF  gyro  rate  measurements  (4  SDF  accelerometers) 
in  body  coordinates.  From  this  point  on,  the  solution  is  that 
of  a conventional  strapdown  INS  with  quaternion  conversion  to 
the  navigation  coordinate  system  followed  by  conventional  iner- 
tial navigation  equations. 

Four  separate  navigation  solutions  are  thus  being  performed  in 
the  computer  array,  each  based  on  a different  pair  of  gyros.  All 
six  possible  two-gyro  combinations  are  not  needed  since  radio 
data  can  isolate  one  marginal  instrument  with  only  four.  The 
six  solutions  would  be  desirable  for  simple  detection  and  isola- 
tion of  a condition  where  two  gyros  degrade  simultaneously  but 
the  increase  in  computer  speed  needed  to  perform  the  additional 
solutions  does  not  appear  warranted. 

The  logic  selected  for  determination  of  which  gyro  pair  is  to  be 
used  in  each  of  the  four  output  computations  is  shown  in  figure 
4-28  in  the  Design  Equation  block.  The  gyro/accelerometers  of 
a given  channel  are  always  used  in  that  channel's  design  equa- 
tions. The  second  gyro/accelerometer-pair  is  that  from  the  next 
sequential  channel  satisfying  the  parity  equations.  Thus,  the 
first  choice  for  channel  1 is  gyros  1 and  2.  If  gyro  2 fails, 
gyro  3 is  used,  if  gyro  3 fails  4 is  used. 

Table  4-3  illustrates  the  alternate  selections  for  various 
failure  modes.  Note  that  following  two  gyro/accelerometer-pair 
failures,  two  computers  are  operating  on  the  same  gyro  pair. 
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TABLE  4-3.  GYRO  PAIR  SELECTION  VS  FAILURE  INDICATION 


CHAN 

0 

1 

2 

3 

4 

1/2 

1/3 

1/4 

2/3 

2/4 

3/4 

i 

1,2 

1,2 

1,3 

1,2 

1,2 

1,3 

1,2 

1,2 

1,4 

1.3 

1,2 

2 

2,3 

2,3 

2,3 

2,4 

2,3 

2,3 

2,4 

2,3 

2,4 

2,3 

2,1 

3 

3,4 

3,4 

3,4 

* ,4 

3,1 

3,4 

3,4 

3,2 

3,4 

3,1 

3,1 

4 

4,1 

4,2 

4,1 

4,1 

4,1 

4,3 

4,2 

4,2 

4,1 

4,1 

4,1 

This  gives  a measure  of  fail-safe  error  detection  capability 
with  a limited  third-fail-op-mode,  depending  upon  self-test 
failure  isolation  efficiency. 

Further  pair— selection  options  could  be  employed.  For  example, 
if  gyros  3 and  4 have  failed,  computers  3 and  4 could  also 
perform  the  1,  2 gyro  solutions,  presumably  as  backup  to  compu- 
ters 1 and  2.  However,  since  computers  1 and  2 are  in  series 
with  gyros  1 and  2 for  I/O  and  compensation,  this  backup  capa- 
bility is  of  no  practical  value.  Gyro/accelerometer-to-computer 
I/O  would  need  to  be  expanded  for  this  modular  type  of  redun- 
dancy and,  as  discussed  in  paragraph  4.3,  is  not  needed  to  meet 
LaRC  reliability  requirements.  Applications  requiring  consider- 
ably higher  reliability  may  need  the  added  I/O  and  software 
modes. 

In  the  normal,  4-channel  or  3-channel  modes,  degradation  of  an 
instrument  affects  two  channels.  The  effect  is  not  necessarily 
of  equal  magnitude  in  each  channel  since  a gyro  error  may  be 
averaged  with  its  mate ' s output  in  one  channel  ( if  the  error  is 
in  a direction  parallel  to  the  appropriate  tetrahedron  edge)  but 
enter  more  strongly  in  the  other  channel  since  less  averaging 
applies.  The  error  is  visible  relative  to  radio  data  in  each 
channel  involved  so  the  marginal  gyro  number  can  be  easily 
deduced.  It  is  assumed  that  the  external  computer  will  indicate 
the  marginal  instrument  to  the  INS  for  use  in  its  redundancy 
management  and  to  alert  maintenance  personnel. 

Behavior  of  position  and  velocity  outputs  for  operation  in  the 
3-gyro  isolation  singularities  can  be  obtained  by  considering 
an  orthogonal  triad  with  a gyro  error  along  one  of  the  spin  axes 
(one  of  the  3-gyro  isolation  singular  directions).  One  can 
deduce  that  for  the  previous  mechanization  consisting  of  paired 
solutions,  there  will  be  three  outputs  of  position  and  velocity. 
The  correct  solution,  using  two  good  gyros,  is  either  the 
largest  or  the  smallest  position/velocity  calculation  depending 
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on  the  sign  of  the  error.  The  computer  using  both  ambiguous 
gyros  is  the  exact  middle  solution.  The  computer  using  the 
known  good  gyro  and  the  bad  (but  non- isolatable ) gyro  is  either 
smallest  or  largest.  Since  the  differences  between  the  middle 
solution  and  either  end  are  identical,  no  fault  isolation  can 
be  made  on  a self-contained  basis.  Assuming  two  perfect  gyros, 
the  middle  solution  has  exactly  half  the  error  of  the  worst 
solution  since  the  error  of  the  bad  gyro  is  averaged  with  the 
good  gyro.  A similar  result  is  expected  with  three  non- 
orthogonal  gyros.  As  the  direction  of  the  gyro  error  changes 
away  from  the  singular  direction  the  two  "bad"  solutions  approach 
each  other. 

In  all  cases,  radio  aid  data  can  be  used  to  determine  the  bad 
gyro,  assuming  errors  are  large  enough.  Therefore,  the  size  of 
position  or  velocity  updates  may  be  used  to  decide  which  channel 
should  be  used  in  the  final  display  or  steering  calculation , 
viz.,  the  channel  requiring  the  smallest  updates.  Averaging  of 
this  decision  is  probably  needed  to  avoid  continuous  switching 
between  channels.  During  periods  of  radio  aid  loss,  the  last- 
selected  channel  should  continue  in  use  since  it  probably  has 
the  lowest  rate-of-change  of  error.  Monitoring  of  channel 
failure  indications  and  errors  between  channels  should  continue 
in  the  external  computer,  however,  so  that  switchover  can  be 
performed  rapidly  upon  detection  of  a channel  failure.  The 
criteria  for  such  a switchover  are  not  defined  at  this  time. 

Rapid  detection  of  errors  within  the  redundant  strapdown  INS  is 
needed  to  avoid  large  transients  in  outputs,  particularly  those 
used  by  the  flight  control  system,  and  to  limit  the  build-up 
of  errors  which  might  be  retained  within  the  INS  and  thus  affect 
the  remainder  of  the  flight.  From  the  computer  mechanization 
diagram  of  figure  4-28,  it  can  be  seen  that  errors  are  monitored 
and  switched  prior  to  their  use  in  the  design  equations.  This 
assures  that  excessive  errors  are  not  propagated  in  the  coordi- 
nate transformation  and  navigation  solutions.  Also  parity 
equation  monitoring  is  performed  at  the  full  strapdown  integra- 
tion rate  of  64  iterations  per  second,  providing  error  detection 
and  isolation  faster  than  the  output  rate  of  32  per  second. 

Reinitialization  of  a computer  can  be  performed  following  large 
error  build-up,  based  on  data  from  one  of  the  other  working 
computers.  These  data  consist  of  quaternions,  vehicle  velocity 
and  direction  cosines.  Other  functions  may  be  computed  from 
these  variables  once  they  are  available.  The  conditions  for 
which  initialization  would  be  performed  are: 

a.  following  replacement  of  a bad  channel  on  the  ground 
so  that  the  flight  need  not  be  delayed  for  a complete 
gyrocompass  alignment,  or 
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b.  following  a gyro  or  accelerometer  performance  recovery, 
to  correct  for  the  error  build-ups  which  occurred 
during  temporarily  poor  operation. 

Another  condition  for  which  re- initialization  might  be  considered 
is  following  elimination  of  any  instrument  from  the  inertial 
calculation  due  to  errors.  Since  there  is  at  least  one  channel 
in  operation  which  does  not  contain  errors  due  to  the  failure, 
the  channel  which  has  reconfigured  could  eliminate  the  quaternion 
or  navigation  errors  which  accumulated  during  the  detection/ 
isolation  process. 

There  is  some  risk  to  this  process,  however,  since  a single 
computer  failure  could  cause  major  errors  in  two  channels  if  the 
failure  occurred  during  the  brief  period  of  time  between  data 
sampling  for  parity  equations  and  data  sampling  for  reinitiali- 
zation. Using  parity  and  initialization  data  from  the  same 
iteration  may  eliminate  the  extremely  low  probability  of  a dual- 
channel failure  mode.  The  decision  of  whether  to  employ  this 
form  of  reinitialization  is  deferred  until  the  final  design 
phase  since  many  hardware  details  must  first  be  established. 

4.5.2  Radio  Aid  Updates 

Assumptions  have  been  made  regarding  radio  aid  information, 
accuracy,  and  filter  characteristics.  These  assumptions  are: 

a.  Radio  aid  produces  geodetic  position  information  with 
no  geometric  dilution,  as  with  Loran  C.  and  with  no 
correlation  to  INS  heading  errors,  as  with  airborne 
radar . 

b.  Radio  aid  data  does  not  include  direct  position  rate 
information  (GPS  is  not  considered). 

c.  Radio  aid  bias  errors  have  been  removed  by  some  means, 
such  as  additional  states  in  the  filter. 

d.  Radio  aid  position  error  consists  of  122m  rms  white 
noise  and  61m,  20  second  correlation  time,  correlated 
noise,  per  axis,  no  correlation  between  axes. 

e.  The  combinational  filter  generates  updates  of  position 
and  velocity  only,  with  fixed  gains. 

f.  INS  position  and  radio  aid  position  coordinates  are 
differenced  in  the  external  computer,  the  weighted 
differences  are  sent  back  to  the  INS  for  correction  of 
indicated  position  and  velocity. 

Updates  of  this  type  are  best  applied  to  the  INS  in  a manner 
which  does  not  cause  pumping  of  Schuler  and  24-hour  oscillations 
due  to  radio  noise.  Therefore,  updates  are  accumulated  in 
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separate  integrators  for  combination  with  inertial  measurements 
in  an  open  loop  fashion. 

From  simulation  data  presented  in  paragraph  5.2,  it  appears  that 
update  of  inertially  derived  attitude  and  heading  (in  addition 
to  position  and  velocity)  is  highly  desirable.  With  large  gyro 
drifts  of  a lower  cost  system,  error  build-up  during  turns  and 
radio  aid  outages  is  excessive  due  to  attitude  and  heading 
errors.  Control  of  these  functions  via  the  radio  aid  informa- 
tion and  a more  sophisticated  filter  would  probably  make  such 
a lower  cost  INS  applicable  to  the  VTOL  mission.  Use  of  time- 
variable  gains  of  a Kalman  approach  is  also  beneficial  if  the 
update  rate  of  the  radio  aid  is  variable  due  to  atmospheric  or 
terrain  conditions. 


4.5.3  Instrument  Compensation 

Instrument  compensation  can  be  classified  into  two  major  cate- 
gories: (1)  static  and  (2)  dynamic. 

Static  compensation  proposed  for  implementation  in  the  INM 
include  the  following  terms: 


a . 

b. 

c. 

d. 

e. 

f . 

g- 

h . 

i . 


Gyro  scale  factor. 

Gyro  torquer  axis  misalignment. 

Gyro  spin-axis  misalignment. 

Gyro  g-sensitive  biases. 

Gyro  biases. 

Gyro  scale  factor  temperature  sensitivity. 

Gyro  g-sensitive  bias  temperature  sensitivity. 
Gyro  bias  temperature  sensitivity. 
Accelerometer  scale  factor. 


j.  Accelerometer  bias. 

k.  Accelerometer  input  axis  misalignment. 

l.  Accelerometer  scale  factor  temperature  sensitivity. 

m.  Accelerometer  bias  temperature  sensitivity. 

The  only  dynamic  compensation  required  to  meet  accuracy  in  the 
assumed  vibration  environment  consists  of  the  inertia  compensa- 
tion. The  dominant  remaining  error  term  then  becomes  that  due 
to  the  gyro  loop  rectification.  This  term  can  be  reduced  by 
software  compensation  at  the  cost  of  additional  hardware  to 
enter  gyro  pick-offs  into  the  computer.  Furthermore,  this  error 
term  is  small  for  most  applications  since  it  is  a multi-axis 
error  phenomenon,  requiring  coherency  for  error  rectification. 
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It  was  therefore  concluded  not  to  include  this  term  until  the 
environment  can  be  better  identified.  Adequate  computer  duty 
cycle  is  available  for  this  compensation  if  it  is  required. 

4. 6 Hardware  Packaging  Options. 

The  packaging  approach  selected  for  the  redundant  strapdown  INS 
is  to  divide  the  total  system  into  four,  identical  units.  This 
configuration  results  in  a low  system  cost  to  the  airlines  when 
compared  with  alternative  methods  due  to  reduced  spares  costs. 
The  trade-off  discussion  leading  to  this  conclusion  is  presented 
in  this  section. 

The  lowest  unit  acquisition  cost  for  a redundant  strapdown  INS 
would  probably  result  if  all  system  components  are  packaged  into 
a single  unit.  This  approach  results  in  minimum  structure, 
connectors,  etc.  Other  factors,  however,  also  influence  the 
packaging  design.  For  example,  spare  units  must  be  provided  at 
all  airports  serviced  by  the  VTOL,  or  if  there  are  more  airports 
than  VTOL 1 s , which  might  be  the  case  in  low  traffic  areas  of  the 
country,  carrying  spares  on  the  VTOL  would  be  more  cost  effec- 
tive. With  single  unit  packaging,  therefore,  this  means  that 
real  avionics  cost  could  be  up  to  double  the  basic  system 
acquisition  cost. 

Other  packaging  arrangements  are  illustrated  in  figure  4-29. 

It  should  be  pointed  out  that  the  digital  rebalance  electronics 
must  be  located  with  the  inertial  instruments  so  they  are  in  the 
same  thermal  environment  and  can  thus  be  calibrated  simultane- 
ously, and  to  avoid  noise  pick-up  from  inter-unit  wiring.  For 
convenience,  a module  consisting  of  a gyro,  2 axes  of  acceler- 
ometer, and  their  associated  digital  rebalance  electronics  is 
called  an  Inertial  Measurement  Module  or  IMM. 

OPTION  A 

A two-unit  configuration  (e.g.,  figure  4-29A)  has  the  advantages 
that  the  total  cost  of  units  in  the  repair  pipeline  is  reduced. 
For  a single-unit  configuration,  when  a component  fails  it  (and 
all  the  remaining  good  parts)  is  sent  to  some  repair  depot. 

This  process  may  take  a significant  length  of  time,  during  which 
the  good  components  are  not  in  use.  The  two-unit  approach 
leaves  at  least  a portion  of  the  good  components  in  the  air- 
craft. As  with  any  capital  investment,  including  the  aircraft 
itself,  the  highest  utilization  rate  results  in  the  lowest 
overall  cost. 

A slightly  higher  packaging  cost  results  with  the  two-unit 
approach.  There  are  added  connectors,  interfacing  hardware,  and 
total  sheet-metal  structure.  Furthermore,  both  units  need  to  be 
kept  as  spares  either  at  the  airport  or  on-board.  Thus,  cost  of 
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spares  outside  of  those  in  the  repair  pipeline  is  not  reduced 
from  the  single-chassis  approach.  An  additional  disadvantage  is 
in  the  area  of  fault  isolation  by  means  of  self-test.  An  IMM 
failure  could  cause  an  apparent  power  supply  or  computer  fail- 
ure. Thus,  there  may  be  a significant  number  of  cases  where  the 
wrong  unit  is  replaced.  Resolving  this  by  having  a power  supply 
within  each  unit  adds  to  net  unit  cost. 

Some  of  the  above  disadvantages  can  be  alleviated  by  having  two 
identical  units,  each  containing  two  IMM's,  two  computers  and 
two  power  supplies.  This  approach  is  similar  to  Option  C of 
figure  4-29,  and  will  be  discussed  in  connection  with  it. 

OPTION  B 

The  5-unit  approach  of  figure  4-29B  further  lowers  the  cost  of 
the  replaceable  unit.  In  addition,  if  the  4 IMM’s  can  be  made 
identical  and  interchangeable,  the  production  savings  in  this 
commonality  will  tend  to  offset  the  cost  of  an  increased  number 
of  chasses.  Also,  perhaps  most  importantly,  total  cost  of 
spares  can  be  reduced  and  dispatch  delays  can  be  minimized  by 
replacement  of  the  faulty  IMM  with  the  other  three  still  in 
operation. 

The  fault  isolation  problems  of  having  a power  supply  ( including 
the  crystal  oscillator,  countdowns,  etc.)  in  another  unit  also 
apply  to  this  configuration.  Again,  separate  power  supplies  in 
each  unit  increases  net  cost.  In  addition,  particular  care  must 
be  exercised  in  the  transfer  of  data  from  the  IMM  to  the  compu- 
ter. It  may  be  desirable  to  have  some  of  the  IMM/computer 
interface  circuitry  in  the  IMM  unit  to  avoid  timing  problems  and 
loss  of  data.  This  could  lead  to  further  fault-isolation 
difficulties. 

OPTION  C 

A further  extension  of  the  concept  introduced  by  Option  B is 
shown  in  figure  4-29C.  An  IMM,  a computer,  and  a power  supply 
are  all  contained  within  a single  unit.  Four  units,  preferably 
identical,  are  interconnected  to  form  the  redundant  strapdown 
system.  Some  means  must  be  devised  to  rotate  the  axes  of  the 
IMM's  during  installation  to  achieve  the  desired  coordinate 
system. 

The  advantages  of  this  packaging  configuration  are: 

• If  the  four  modules  are  identical  and  interchangeable, 
only  one  need  be  maintained  as  a spare  in  many  air- 
ports. This  is  a function  of  the  amount  of  traffic 
through  the  airport  and  unit  failure  rate.  In  the 
limiting  case  of  on— board  spares,  only  a single  unit 
is  required.  Program  cost  is  approximately  1.25/2.00 
or  62.5%  of  the  single-unit  packaging  cost. 
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• Net  hardware  in  the  spares  pipeline  is  only  25%  of  that 
in  the  single-unit  design. 

• A nearly  complete  function  is  contained  within  a unit 
simplifying  fault  isolation.  (The  single-unit  design 
has  the  advantage,  however,  in  essentially  eliminating 
the  need  for  self-contained  fault  isolation  capability 
to  subsystems  except  for  redundancy  management.) 

• Self-contained  fault  isolation  separating  computer 
failures  from  IMM  failures  is  not  needed. 

• A unit  may  be  replaced  with  the  other  three  running, 
potentially  reducing  dispatch  delays  due  to  pre-flight 
failures. 

• The  added  amount  of  hardware  for  four  chasses  tends  to 
be  offset  by  the  cost  savings  of  higher  quantity  pur- 
chases of  identical  chasses. 

• Other  users  may  only  need  fail-op  or  simplex.  Simple 
deletion  of  one  or  two  channels  achieve  the  desired 
configuration. 

A quantitative  trade-off  of  the  above  considerations  is  presented 
in  Appendix  C.  In  summary,  total  cost  of  ownership  is  reduced 
by  more  than  12  million  dollars  over  a 10-year  period  (200  air- 
craft), from  a single-unit  package,  by  applying  the  above 
4-module  packaging  approach. 

If  the  above  concept  is  extended  into  8-modules  by  separating 
each  computer  into  a unit,  the  power  supply  and  fault  isolation 
aspects  become  difficult  and  more  costly.  Flightline  or  on- 
board spare  requirements  are  not  reduced,  only  repair  pipeline 
unit  costs  are  improved.  This  net  minor  improvement,  however, 
is  not  felt  worth  the  added  complications. 

Many  of  the  above  benefits  can  be  achieved  by  having  2 IMM's, 

2 computers,  and  2 power  supplies  in  one  module,  with  a total 
system  composed  of  2 such  modules.  The  full  savings  of  spares 
cost  cannot  be  achieved  as  effectively  as  with  the  4-module 
method , however . 

IMM  AXIS  ORIENTATION 

The  packaging  arrangement  of  Option  C promises  significant 
program  cost  savings,  provided  that  all  four  modules  can  be  made 
identical  and  interchangeable.  Also,  since  a physical  rotation 
is  involved  and  module- to-module  alignments  must  be  held  to 
approximately  10  arc  seconds,  the  practicality  of  the  approach 
must  be  demonstrated.  Such  a simple  practical  implementation 
was  found  and  is  described  in  paragraph  6.2.10  of  this  report. 

The  remainder  of  this  section  describes  other  implementations 
which  were  considered. 
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The  geometry  of  a tetrahedron  may  be  illustrated  by  means  of  a 
cube,  as  shown  in  figure  4-30A.  Clearly,  the  sides  of  the 
tetrahedron  connecting  the  four  corners  of  the  cube  are  equal 
since  each  of  the  diagonals  of  the  cube  faces  are  equal. 

The  gyro  spin  axes  may  now  be  placed  in  a tetrahedral  configu- 
ration by  placing  a vector  from  the  geometric  center  of  the  cube 
to  each  of  the  four  corners  of  the  tetrahedron,  as  shown  in 
figure  4-30B.  The  orientation  of  each  of  the  two  gyro  input 
axes  will  be  discussed  later. 

Figure  4-31  shows  how  one  gyro  spin  axis  may  be  moved  from  one 
of  the  tetrahedral  axes  to  another  by  means  of  180°  rotations 
about  two  axes  90°  apart.  This  is  convenient  from  a packaging 
point  of  view  since  electronics  boxes  are  usually  rectangular  in 
shape.  Rotation  of  the  cube  containing  a single  gyro  spin  axis 
180°  about  the  dashed  horizontal  line  of  figure  4-31  (1)  results 
in  an  orientation  of  the  spin  axis  along  another  of  the  tetra- 
hedral axes  (2).  Rotation  of  the  cube  180°  about  a vertical 
axis  lines  up  the  spin  axis  in  the  third  tetrahedral  axis  (3). 
Rotation  180°  again  about  the  horizontal  axis  places  the  spin 
axis  in  the  fourth  orientation  (4) , completing  the  tetrahedron. 

One  manner  of  implementing  an  electronic  chassis  design  is 
illustrated  in  figure  4-32.  The  chassis  is  made  symmetrical 
about  the  vertical  and  horizontal  axes  to  allow  the  above 
rotations.  The  inertial  instruments  are  installed  in  the  center. 
The  connectors  need  not  have  symmetry  about  the  horizontal  axis 
since  the  aircraft  or  installation  rack  connectors  can  be  180° 
apart  between  positions.  The  four  instrument  packages  would 
need  to  be  compliant  relative  to  the  electronics  portion  of  each 
chassis  to  provide  some  self-aligning  as  the  four  units  are 
clamped  together.  This  general  method  appears  impractical, 
however,  due  to  the  tight  requirements  on  alignment  repeatability 
(10  arc  seconds).  Errors  build  up  from  one  end  of  the  stack  to 
the  other,  and  clamping  over  that  great  a distance,  e.g.  10 
inches,  produces  uneven  pressures  resulting  in  unpredictable 
alignment.  An  additional  disadvantage  is  that  a single  unit 
cannot  be  replaced  without  disturbing  the  other  three.  There- 
fore, the  ground  alignment  process  must  be  discontinued  during 
the  maintenance  activity. 

A method  of  achieving  the  desired  tetrahedral  orientation  is 
through  four  90°  rotations.  A spin  reversal  of  the  gyro  for  two 
of  the  orientations  can  be  used  to  exactly  produce  the  tetra- 
hedron. If  the  spin  reversal  is  not  done,  the  orientation  is 
identical  to  the  semioctahedral  geometry  described  earlier. 

The  manner  in  which  the  tetrahedron  can  be  produced  with  90° 
rotations  about  a single  axis  is  illustrated  in  figure  4.33. 
Positions  (2)  and  (4)  with  spin  direction  reversals  from  the 
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nominal  condition  are  identical  to  positions  (3)  and  (4)  of 
figure  4-31.  The  packaging  simplifications  are  clear  from  the 
conceptual  drawing  in  figure  4-34.  The  four  instrument  blocks 
are  not  allowed  to  rotate  relative  to  the  electronics  but 
contain  sufficient  compliance  to  allow  being  drawn  or  pushed 
against  a common  alignment  block.  This  alignment  block  is  of 
relatively  small  size  and  high  rigidity  and  thus  repeatable 
alignments  will  be  achieved. 

A preliminary  packaging  design  which  requires  separate  actions 
for  connector  and  block  engagements  is  given  in  paragraph  6.2.10 
of  this  report.  Further  investigation  is  warranted  to  devise  a 
single-action  locking  mechanism  for  improved  maintainability. 
Factory  calibration  equipment  restrictions  also  indicate  that  it 
is  desirable  to  have  block  engagement  on  the  end  of  the  unit 
rather  than  on  the  side.  Several  similar  units  can  then  be 
installed  side-by-side  on  the  rate  table  used  for  factory  cali- 
bration for  more  efficient  utilization  of  this  high  cost  item. 

Gyro  and  accelerometer  input  axis  orientations  are  easily 
maintained  through  the  90°  rotations  for  the  geometry  selected 
in  figure  4-19.  Maximum  avoidance  of  all  potential  3-gyro 
isolation  singularities  is  also  provided. 

The  geometry  recommended  in  the  preliminary  CR-132419  report 
was  to  orient  three  gyros  orthogonally  with  the  fourth  bisecting 
the  orthogonal  triad.  The  inherent  asymmetry  of  this  approach 
does  not  allow  the  simplified  packaging  arrangement  of  the 
tetrahedron  or  semioctahedron.  It  thus  produces  clear  cost-of- 
ownership  disadvantages  and  is  not  recommended  for  use. 

4.7  Redundant  Strapdown  INS  Trade-Off  Summary 

The  redundant  strapdown  INS  design  features  resulting  from  the 
trade-off  study  described  in  this  report  are  summarized  below: 

• The  total  redundant  strapdown  INS  comprises  four 
identical  plug— in  modules  for  low  cost-of-ownership. 

• Module-level  redundancy  (printed-circuit  card,  circuit 
element,  CPU,  etc.)  is  not  employed  except  in  the  case 
of  instruments,  to  achieve  minimum  system  cost.  Proba- 
bility of  complete  system  failure  through  both  fail-op 
levels  is  significantly  lower  than  LaRC  requirements. 

• Hardware  failure  detection  and  isolation  (FDI)  is  not 
used  (software  only) , except  for  a small  amount  in 
computer  synchronization  logic.  The  final  vote  is 
assumed  to  be  in  external  hardware. 

• The  system  consists  of  4 TDF  tuned— gimbal  gyros  and  8 
SDF  accelerometers  oriented  in  a regular  semioctahedral 
geometry,  with  4 GP  digital  computers.  This  results  in 


137 


403314 


a low  cost  packaging  approach  and  uniform  redundancy 
management  with  very  straightforward  software 
processing . 

Gyro  and  accelerometer  data  of  each  module  are  input  to 
only  the  computer  of  that  module.  Compensation  for 
predictable  errors  is  applied  in  only  that  computer  for 
minimum  I/O  and  computer  duty  cycle  penalty. 

The  probability  of  recovery  from  some  second  failures 
is  less  than  unity  due  to  information  limits  of  3 TDF 
gyros.  These  failures  are  always  detectable,  thus 
resulting  in  a fail-safe  condition.  Furthermore, 
recovery  probability  is  sufficiently  high  to  meet  the 
system  reliability  specification,  and  approaches  unity 
on  outputs  to  the  flight  control  system. 

Gyro  input  axes  are  oriented  away  from  3— gyro  failure 
isolation  singularities  resulting  from  these  informa- 
tion limits  to  improve  recovery  probability. 

The  mechanization  of  the  computer  ensemble  is  struc- 
tured to  allow  aid  to  self-contained  FDI  from  eternal 
radio  updates  and  to  allow  complete  recovery  from 
extended  operation  in  3-gyro  isolation  singularities 
when  the  failed  gyro  is  finally  isolated. 

Parity  equations  are  formed  by  comparison  of  gyro 
measurements  at  the  edges  of  a semioctahedron. 

Processing  of  parity  equations  consists  of  a low  pass 
filter. 

Fault  isolation  consists  of  a computer  table  look-up 
process.  Further  processing  of  filtered  gyro  parity 
equations  including  compensation  for  normal  scale  factor 
deviations  and  computation  of  error  probabilities  is 
recommended  to  reduce  system  errors  just  prior  to 
redundancy  management  switching.  Incorporation  of  these 
refinements  will  be  done  at  a later  date  following 
further  analysis,  simulation  and/or  testing. 

Instruments  which  are  indicated  as  failed  will  simply 
be  switched  out  of  the  computation.  Weighted  combi- 
nations for  output  transient  suppression  are  not  needed. 

Instruments  switched  out  of  computations  due  to  soft 
failure  detection  continue  to  be  monitored  and  if  only 
marginally  bad  will  be  re-used  for  a third  fail-op 
level  or  to  resolve  ambiguous  second  failures. 
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All  four  computers  will  do  the  same  FDI  processing. 

A computer  always  uses  its  attached  instruments  in  its 
output  computations.  The  choice  of  the  second  instru- 
ment depends  upon  redundancy  management  decisions. 

Reinitialization  of  one  computer  to  another  is  per- 
formed following  replacement  of  a bad  channel  before 
flight.  Consideration  will  be  given  in  the  future  to 
reinitialization  following  any  failure  switching,  or  a 
computer  error  transient.  The  impact  of  a failure  mode 
within  or  near  a 3-gyro  isolation  singularity  is  thus 
considerably  reduced. 

Tighter  error  detection  limits  will  be  used  during 
ground  operation  to  reduce  the  probability  of  take-off 
with  failed  or  marginal  instruments. 
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V . SYSTEM  ANALYSES 

The  analytical  results  presented  in  this  section  indicate  the 
following  performance. 

TWO  CHANNEL  PERFORMANCE  PREDICTIONS 


Predicted  Performance**  Requirement 


1 . 

Position  Error: 

56  + 41t*  meters  CEP 

2. 

Velocity : 

0.50  m/sec  cev 

0.49 

m/sec  cev 

3. 

Attitude: 

a.  Verticality 
Roll) : 

(Pitch  and 
0.3  + 1.4t  min 

(la) 

O 

• 

O 

rms 

b.  Heading: 

5.8  + 7.5t  mih 

(la) 

0.2° 

rms 

*t  is  in  hours 
**with  radio  updates 


As  discussed  in  paragraph  4.5.3,  'Instrument  Compensation',  the 
errors  encountered  in  strapdown  inertial  navigation  systems  may 
be  categorized  into  two  general  classifications,  (1)  dynamic 
errors  and  (2)  static  errors. 

Dynamic  errors  are  those  produced  as  a result  of  the  vibration 
environment.  Paragraph  5.1  contains  the  results  of  this  analysis. 
The  assumed  environment  encountered  includes  wide  band  noise  plus 
a sinusoidal  resonance.  The  results  of  the  dynamic  analysis  are 
in  terms  of  equivalent  instrument  biases.  These  biases  are  then 
introduced  into  the  strapdown  simulation  program  together  with 
the  static  errors  (instrument  frequency  independent  errors). 

Figure  5-1  illustrates  this  methodology. 

The  final  results  were  obtained  from  a Monte  Carlo  simulation  of 
the  strapdown  inertial  navigation  system  operating  in  a closed 
path  trajectory  over  a 1.2  hour  period,  with  open  loop  velocity 
and  position  updating.  Paragraph  5.2  presents  the  results  of 
this  simulation  and  a description  of  the  simulator. 
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Figure  5-1.  System  Analysis  Methodology 


403314 


The  system  reliability  calculation  results  in  the  following 
probability  of  system  failure: 


Flight Time 


Channel 
MTBF  ( Hr ) 

0.5  Hr 

1.0  Hr 

Full  System 
Accuracy 

2000 

4.6  x 10 

1.8  x 10-9 

4000 

■ 

c o in"10 

5.2  x 10 

Outputs  to  Flight 
Control  System* 

2000 

4.7  x 10  11 

3.8  x 10"10 

4000 

-12 

4.5  x 10 

3.6  x 10-11 

C. 

It  is  well  within  the  10”  failure  probability  requirement  for  a 
0.5  hour  flight.  Very  conservative  assumptions  have  been  used 
in  calculating  system  reliability.  Furthermore,  use  of  radio 
and  update  data  can  improve  system  reliability  by  resolving  the 
3-gyro  isolation  ambiguity,  but  this  capability  is  not  included 
in  the  failure  probability  determination. 

5 . 1 Dynamic  Error  Analysis 

The  dynamic  errors  have  been  evaluated  for  a strapdown  navigation 
system  while  operating  in  a helicopter-type  of  environment.  The 
resulting  errors  on  a per  channel  basis,  are  summarized  in 
table  5-1-  For  a combined  sinusoidal  and  random  environment,  the 
resulting  dynamic  biases  are  1 ug  and  .02° /hr /channel . 

The  total  bias /channel  is  made  up  of  errors  due  to  gyro  loop, 
accelerometer  loop,  and  system  type  dynamic  errors.  A separate 
analysis  was  performed  for  both  an  assumed  sinusoidal  and  random 
vibration  environment.  The  detailed  breakdown  of  all  the  error 
sources  considered,  and  their  resulting  contribution  to  the  total 
error,  are  shown  in  tables  5-2  and  5-3,  (sinusoidal  and  random 
environments  respectively).  Each  table  shows  the  individual 
error  source,  the  coefficient  used,  the  vibration  motion  and  the 
resulting  maximum  error.  For  errors  dependent  upon  multiaxis 
motion,  the  error  was  reduced  by  .3  to  account  for  phase  correla- 
tion probability. 

The  environments  used  in  this  analysis  are  summarized  in  table 
5-4.  These  were  based  on  review  of  available  data,  primarily 
reference  [10] . The  total  environment  is  considered  to  be  made 
of  an  overall  random  spectrum  with  some  discrete  frequencies 
of  vibration. 

The  dynamic  errors  are  computed  for  the  dry-tuned  instrument 
rebalance  loops  as  described  in  paragraph  6.2.1. 

♦Attitude  rates  and  accelerations  in  body  coordinates. 
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The  errors  as  shown  in  tables  5-2  and  5-3  are  generated  with 
the  following  assumptions: 

a.  All  error  sources  are  excited  simultaneously. 

b.  The  environments  exist  at  the  same  levels  at  all  times 
on  all  axes. 

c.  The  phasing  of  the  vibrations  are  always  such  as  to 
maximize  the  resulting  error. 

d.  The  random  and  sinusoidal  environments  exist 
simultaneously . 

e.  The  environments  used  are  worse  case  levels  from 
test  data. 

f . The  total  error  is  reduced  by  50%  for  time  weighting  of 
their  existence  during  flight. 

g.  All  errors  are  assumed  to  be  independent  and  thus 
RSS ' d for  a total  error. 

h.  A computer  utilizing  a partial  fifth  order  algorithm 
at  a 64  Hz  iteration  rate. 

i.  Only  pseudo  coning  correction  included  in  the  software 
compensation . 

The  errors  shown  in  table  5-2  for  the  sinusoidal  environment  of 
table  5-4  are  computed  as  follows: 

Error  = (Error  Coefficient X (Vibration) 

X( Computer  Attenuation ) fi 

The  error  coefficients  are  shown  in  figures  5-5  through  5-14  for 
those  which  are  frequency  dependent.  The  error  coefficients 
shown  on  table  5-2  are  obtained  from  these  figures  at  the 
frequency  (fi)  of  the  input  vibration.  A brief  description  of 
system  dynamic  errors  is  shown  in  figure  5-26.  The  computer 
attenuation  for  system  errors  based  on  a 64  Hz,  fifth  order 
algorithm  is  shown  in  figure  5-27. 

The  errors  shown  in  table  5-3  for  the  random  vibration  envi- 
ronment of  table  5-4  are  computed  as  follows: 

Error  = f( Error  Coefficient)  X (Power  Spectral  Density) 

X (Computer  Attenuation )df 

The  coefficients  are  shown  in  figures  5-5  through  -14  for  those 
which  are  frequency  dependent.  Before  arriving  at  the  final 
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error , sn  cinslysis  was  performed  to  estimate  the  dynamic  errors 
as  a function  of  vibration  bandwidth  for  a normalized  random 
environment.  The  normalized  environments  are  shown  in  figure  5-2. 
The  resulting  RMS  values  as  a function  of  bandwidth  are  shown  in 
figures  5-3  and  -4  for  the  linear  and  angular  spectra  respectively. 
The  resulting  integrated  error  coefficient  vs  vibration  bandwidth 
are  shown  in  figures  5—15  and  —25.  If  new  vibrations  of  differ- 
ent bandwidths  or  levels  are  used,  the  resulting  errors  can  be 
quickly  determined. 

5.1.1  Computation  Errors 

The  quaternion  integration  routine  proposed  is  a partial  fifth 
order  algorithm.  The  truncation  error  for  this  order  algorithm 
will  introduce  negligible  quaternion  drift  for  input  angular 
rates  above  several  hundred  degrees  per  second. 

Figure  5-28  illustrates  the  error  related  to  the  use  of  finite 
digital  word  lengths.  A plot  of  word  length  versus  equivalent 
quaternion  drift  in  degrees  per  hour  illustrates  the  propor- 
tionate relationship  of  equivalent  drift  to  computer  iteration 
rate.  Note  for  a 32  Hz  quaternion  computation  rate  with  a 32 
bit  word  length  introduces  an  equivalent  drift  rate  of  .0016  deg/hr 
in  the  worst  case. 
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TABLE  5-1.  DYNAMIC  ERROR  SUMMARY 
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TABLE  5-2.  DYNAMIC  ERROR  SUMMARY-SINUSOIDAL  VIBRATION  ( 3o ) 


TABLE  5-2.  DYNAMIC  ERROR  SUMMARY  SINUSOIDAL  VIBRATION  (3o)(cont) 
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0 033  (OEG/SECnMS)2/HZ  0 30  HZ  ANGULAR  0 083  OEG/H R (3  SIGMA)  UN*AR  5^9  (3  SIGMA) 

0 00045  (to MS,2/HZ  0 200  HZ  0.027  DEG/HR  (1  SIGMA>  2 m9  M SIGMA) 


TABLE  5-4.  PERFORMANCE  ENVIRONMENT  SUMMARY 
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LINEAR  ENVIRONMENT  SPECTRUM 
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Figure  5-2.  Normalized  Random  Vibration  Spectrum 


Figure  5-3.  RMS  Acceleration  Input  vs  Bandwidth  of  Wide  Band 

Random  Linear  Vibration 
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Figure  5-4.  RMS  Rate  Input  vs  Bandwidth  of  Wide  Band 
Random  Angular  Vibration 
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Figure  5-10.  Accelerometer  Scale  Factor  Asymmetry  Error  For 

Random  Input  Accelerations 
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Figure  5-13.  Pseudo  Coning  Error  Coefficient  due  to  Mismatched  Gyro  Loops 
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-14.  Pseudo  Sculling  Error  Coefficient  Due  to  Sensor  Loop  Mismatch 


403314 


164 


403314 


165 


Figure  5-16.  Gyro  Loop  Rectification  Error  Vs  Vibration  Bandwidth-Cross  Axis 
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Figure  5-18.  Gyro  Anisoelastic  Error  Vs  Vibration  Bandwidth 


Figure  5-19.  Accelerometer  Loop  Rectification  Error  Vs  Vibration  Bandwidth 
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Figure  5-20.  Accelerometer  g Error  Vs  Vibration  Bandwidth 
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Figure  5-23.  Pseudo  Coning  Error  Vs  Vibration  Bandwidth 
Computer  Frequency  Response  Included 
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5.2  Error  Simulation  of  Radio-Strapdown  Navigator 

5.2.1  Introduction 

An  error  simulation  of  a radio-inertial  (strapdown)  navigator 
traversing  a 1.2  hour  closed  trajectory  was  performed  using  a 
digital  computer  program  developed  under  Litton' s IRAD  program 
76G-lD( B ) . The  simulation  does  not  as  yet  take  into  account 
the  instrument  redundancy  concepts  incorporated  in  the  Langley 
study,  but  models  instead  a simple  orthogonal  triad  configura- 
tion. Results  are  thus  conservative,  applying  essentially  to 
performance  of  one  airborne  computer  output  without  averaging  the 
four  computer  outputs. 

The  inertial  error  budgets  (two  are  simulated  for  tradeoff 
purposes)  are  each  composed  of  45  error  sources  and  the  radio 
error  budget  of  four  error  sources  (two  per  axis).  The  radio 
and  inertial  position  data  is  used  to  estimate  the  errors  in 
both  position  and  velocity  via  a simple  open  loop  constant  gain 
estimator . No  error  estimates  of  heading  and  attitude  were 
made. 

Paragraphs  5.2.2,  3 and  4 present  the  error  models  and  budgets 
simulated.  Paragraph  5.2.5  displays  and  discusses  the  simulated 
updating  concept.  Details  of  the  trajectory  are  presented  in 
paragraph  5.2.6.  A brief  discussion  of  the  simulation  program 
is  contained  in  paragraph  5.2.7.  Paragraphs  5.2.8  and  5.2.9 
present  and  discuss  both  the  free-inertial  and  the  radio-inertial 
error  profiles  for  the  two  inertial  error  budgets  simulated. 
Finally  paragraph  5.2.10  relates  the  results  to  the  Langley 
specification. 

5.2.2  Strapdown  Inertial  Error  Model 

The  inertial  error  model  incorporated  into  the  simulation  program 
is  based  on  a navigator  consisting  of  an  orthogonal  instrument 
set  (gyros  and  accelerometers)  affixed  to  the  aircraft,  and 
computing  in  a local  level  frame.  The  local  level  computation 
frame  is  a wander  azimuth  frame  whose  wander  angle  Ct  is  given  by 


See  figure  5-29. 
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The  error  dynamics  are  summarized  (not  derived  herein)  in  equa- 
tions 5.2-2  to  5.2-20,  where  the  symbols  are  defined  as  follows 
(all  components  are  in  the  computation  frame): 


n 

x,  y,  z 
P 

x,  y,  z 

0) 

x,  y,  z 

x,  y,  z 
V 

x,  y,  z 
R 

x>  y 

A 

x,y,  z 
6P 

x,  y,  z 

60 

x,  y,  z 
X,  y,  Z 


6 V 

x,  y,  z 
6h 


x,  y,  z 

7 

x,  y,  z 


Components  of  earth  rate 

Components  of  transport  rate  of  computation  frame 

Components  of  inertial  angular  rate  of  computation  frame 

Components  of  transport  rate  plus  earth  rate 

Components  of  vehicle  velocity  relative  to  earth 

Radii  of  curvature 

Components  of  specific  force 

Transport  rate  error 

Computation  frame  attitude  errors 

Instrument  frame  attitude  errors 

Velocity  errors 
Altitude  error 

Alignment,  updating,  etc  controls 
Components  of  composite  gyro  drift 
Components  of  composite  accelerometer  bias 
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UJ  = 
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6 V = A v - Ad)  - ll  6V  + u 6V  - V 6p  -I-  V 5p 
x y z z y y z z y z y y z 

-2(VB  +VB)60  + 2S2  V 66  + 2fi  V 60  + t 4 7 (5.  2-17) 

y y 51  z * * y y xzzvx  x 


6 V = A <J)  - A__d>„  - )x^6Vv  + nv5V^  - V^fip  ^ + V_5?x 


TABLE  5-5.  LANGLEY  ERROR  BUDGETS 


ERROR  SOURCE 

X GYRO  BIAS  DEG  HR 

Y BYRO  BIAS  DEG  HR 
Z GYRO  BIAS  DEG  HR 
X ACC  BIAS  MICRO  G 

Y ACC  BIAS  MICRO  G 
Z ACC  BIAS  MICRO  G 

X GYRO  MISALIGNMENT  < WY)  - MICRO  RADIANS 
X GYRO  MISALIGNMENT  ( WZ)  MICRO  RADIANS 

Y GYRO  MISALIGNMENT  | WZ)  - MICRO  RADIANS 

Y GYRO  MISALIGNMENT  (-WXI  MICRO  RADIANS 
Z GYRO  MISALIGNMENT  [ WX)  - MICRO  RADIANS 
Z GYRO  MISALIGNMENT  (- WY)  - MICRO  RADIANS 
X ACC  MISALIGNMENT  { AY)  - MICRO  RADIANS 
X ACC  MISALIGNMENT  <-AZ>  - MICRO  RADIANS 

Y ACC  MISALIGNMENT  | AZ)  - MICRO  RADIANS 

Y ACC  MISALIGNMENT  <-AX|  MICRO  RADIANS 
Z ACC  MISALIGNMENT  ( AX)  - MICRO  RADIANS 
Z ACC  MISALIGNMENT  (-AY)  - MICRO  RADIANS 
X GYRO  G DRIFT(-AX)— OEG/HR/G 

X GYRO  G DRIFT  (— AY)— DEG/HR/G 

Y GYRO  G DRIFT  (-AYJ-DEG/HR/G 


NO.  005 

1 4000 E -02 
1 4000E  -0? 
1 4000E-02 
6.5000E  01 

6 5000E  01 
6.5000E  01 
7.5000E  01 

7 5000 E 01 
7 5000E  01 
7.5000E  01 
7.5000E  01 
7.5000E  01 
7.5000E  01 
7.5000E  01 
7 5000 E 01 
7.5000E  01 
7 5000 E 01 
7 5000 E 01 
1 OOOOE -02 
1 OOOOE -02 
i iwmc-.n*) 


NO.  004 

1 OOOOE  01 
1 OOOOE  -01 
1 OOOOE -01 
6 5000E  01 
6 5000 E 01 

6 5000 E 01 

7 5000 E 01 
7 5000 E 01 
7.5000E  01 
7 5000 E 01 
7 5000 E 01 
7 5000 E 01 
7 5000 E 01 
7.5000E  01 
7 5000E  01 
7 . 50 00  E 01 
7.5000E  01 
7 5000 E 01 
1 OOOOE -02 
1 OOOOE -02 
i nrinnc  no 
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The  inertially  derived  latitude  ( <t> ) is  first  corrected  with  the 
present  estimate  of  its  error  (6$),  yielding  the  best  estimate  of 
present  latitude  for  display  purposes.  A similar  procedure  is 
used  to  obtain  the  best  estimate  of  north  velocity 

(VN  = VN  - 6Vn)  for  display  purposes. 

At  an  update  time  (every  AT),  the  best  estimate  of  present  lati- 
tude is  compared  with  the  radio  indicated  latitude,  forming  the 
observable  difference  (=  a(V  - *r)).  The  observable  difference 
multiplied  by  the  constant  gains  Kv  and  Kx  form  the  incremental 
error  estimates  for  velocity  and  position  respectively.  These 
incremental  estimates  are  added  to  the  existing  error  estimates 
thus  forming  new  (updated)  error  estimates.  Note  that  between 
updates  the  velocity  error  estimate  remains  constant,  but  the 
position  error  estimate  is  changed  by  the  time  integral  of  the 
velocity  error  estimate. 

5.2.6  Simulated  Trajectory 

A plan  view  of  the  simulated  trajectory  is  shown  in  figure  5-31. 

It  consists  of  three  take-offs  and  three  landings  around  a closed 
loop,  simulating  an  intracity  airbus.  The  total  time  of  the  flight 
is  1.2  hour s . 

Each  take-off  consists  of  a turning  climb  during  which  the  air- 
craft changes  heading  by  180°.  The  landing  patterns  at  stations 
two  and  three  are  similar  and  consist  of  a descent  followed  by  a 
turning  descent  during  which  the  aircraft  changes  heading  by  270°. 
The  landing  at  station  one  differs  from  that  at  two  and  three 
in  that  the  heading  change  is  225°. 

Each  of  the  maneuvers  (climb,  descent,  turn)  is  performed  by 
pitching  and/or  rolling  the  aircraft.  Since  the  strapdown  instru- 
ments are  attached  to  the  aircraft  body,  they  will,  of  course, 
experience  a change  in  geographic  direction  just  as  the  aircraft 
body  does.  Thus,  for  example,  when  taking  off  after  ground 
alignment,  the  accelerometer  biases  rotate  180°  due  to  the  change 
in  aircraft  heading. 

Figures  5-32,  -33  and  -34  show  detailed  plan  views  of  the  first, 
second  and  third  stations  respectively.  In  each  case  the  plot  is 
made  with  the  station  at  the  origin. 
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LONGITUDE  (KM) 

STRAPDOWN  TRAJECTORY  TRAJ002  (FIRST  STATION  DETAIL) 

Figure  5-32.  First  Station  Detail 
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LONGITUDE  (KM) 

STRAPDOWN  TRAJECTORY  TRAJ002  (SECOND  STATION  DETAIL) 


Figure  5-33. 


Second  Station  Detail 
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LONGITUDE,  (KM) 


Figure  5-34.  Third  Station  Detail 
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5.2.7  Simulation  Program 

The  basic  program  used  for  the  strapdown  radio-inertial  error 
simulations  is  Litton ' s M0D6DF . It  is  written  entirely  in 
FORTRAN  and  has  been  compiled  on  many  computer  systems  including 
the  IBM  7094,  7040,  360  and  370  series. 

Since  the  inception  of  the  program,  Litton  has  expanded  it 
(principally  in  size)  to  accommodate  the  ever  increasing  demand 
for  more  complex  simulations.  Because  of  its  modular  structure 
it  is  adaptable  to  numerous  different  types  of  simulations  ( air_ 
craft,  ship,  missile  and  jeep  dynamics,  Kalman  filters,  navigation 
error  dynamics,  etc.). 

The  simplified  structure  of  the  computer  program  is  illustrated 
in  figure  5-35.  As  shown,  the  physical  system  being  simulated 
consists  of  a group  of  modules  or  "black,  boxes".  Typically,  these 
represent  computer  functions,  sensors,  and  the  vehicle  frame  and 
its  external  environment.  After  the  usual  executive  functions 
have  been  performed,  including  input  of  data,  the  actual  mission 
trajectory  simulation  begins.  Using  a fourth-order  Runge— Kutta 
integration  algorithm,  the  trajectory  progresses  at  each  point 
in  time  by  processing  the  differential  equations  in  each  module 
to  advance  the  solution  one  step  At  in  time. 

The  integration  is  automatic  and  unaffected  by  modifications  in 
old  modules  or  the  inclusion  of  new  module  subroutines , even 
though  these  contain  new  variables  to  be  integrated.  Similarly, 
random  noise  sources  can  be  called  automatically  at  each  step  of 
the  integration.  If  so  desired,  it  is  possible  to  replace  the 
Runge-Kutta  integration  algorithm  with  a simpler  integration 
algorithm.  This  in  fact  is  done  when  simulating  Kalman  filter 
covariance  matrix  propagation. 

At  the  end  of  the  mission  trajectory  simulated,  post-processing 
of  data  can  occur  (such  as  statistical  processing),  as  well  as 
computations  required  in  automatically  setting  up  the  next  run 
of  a series  of  runs.  Extensive  RMSing,  RSSing  and  plotting 
programs  augment  the  M0D6DF  program. 

The  various  concepts  and  modules  required  for  the  strapdown 
inertial  error  simulation  were  developed  under  Litton 's  IRAD 
program  76G-1D(B).  The  specific  application  to  the  Langley  study 
particularized  the  error  values  and  the  updating  concept. 

The  procedure  used  to  perform  the  simulations  contained  herein 
consisted  of  four  principal  computer  job  steps.  Selection  of 
four  job  steps  economizes  on  the  computer  time  required  for  the 
simulations.  The  four  job  steps  are 
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EXECUTIVE  PROGRAMS 
(INPUT  OF  DATA. 

CALL  SUBROUTINE.  ETC.) 


BEGIN  FLIGHT 


SUBROUTINES  FOR  CONTROL 
DURING  RUN  (PRINTOUT.  ETC.) 


INTEGRATION 

LOOP 


DESCRIPTION  OF  PHYSICAL  SYSTEM 
BEING  SIMULATED  MOOULES) 


COMPUTERS 


AIRFRAME  AND 
EXTERNAL  ENVIRONMENT 


INTEGRATION  ALGORITHM 
(ADVANCE  TRAJECTORY  At) 


ENO  OF  FLIGHT 


L~r~r — 1 


SENSORS 


SERIES 
OF  RUNS 


POST  PROCESSING  OF  DATA 


SET-UP  OF  NEW  RUN 


Figure  5-35.  Simplified  Structure  of  the  MOD6DF  Program 
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a.  Trajectory  variables'  generation  and  storage 

b.  Strapdown  free  inertial  error  response  generation  and 
storage 

c.  Radio  and  inertial  updated  error  responses  generation 
and  storage 

d.  RSSing  and  storage  of  radio  and  inertial  updated  error 
responses 

Additional  job  steps  are  used  to  obtain  the  desired  graphical 
outputs . 

The  first  job  step  is  concerned  with  only  trajectory  generation. 
The  aircraft  is  commanded  in  pitch,  roll  and  thrust  to  traverse 
the  desired  flight  profile.  During  this  portion  of  the  simula- 
tion all  the  trajectory  variables  required  for  the  strapdown  free 
inertial  error  response  generation  job  step  are  stored  as  a data 
set.  These  data  include,  for  example,  components  of  specific 
force  and  angular  rate  in  both  the  body  and  navigation  coordinate 
systems.  In  addition  the  transformation  matrix  relating  the 
body  and  navigation  coordinate  systems  is  also  stored.  This 
seemingly  redundant  storage  of  data  avoids  the  necessity  of  per- 
forming some  transformations  during  the  second  job  step,  thus 
saving  computer  time. 

During  the  second  job  step  the  computer  program  reads  the  stored 
trajectory  data  and  propagates  specified  error  sources  through 
the  strapdown  free  inertial  error  dynamics.  Specifically,  for 
the  simulations  performed  herein,  all  45  inertial  error  sources 
were  propagated  simultaneously  through  the  dynamics , twenty  times , 
being  randomly  selected  for  each  run  (twenty  Monte  Carlos).  These 
results  were  RMS ' d to  give  the  final  RMS  response  of  the  system 
(free  inertial).  In  addition  the  longitude  (6  A cos  <t> ) , latitude 
(6$),  east  velocity  (6VE)  and  north  velocity  (6VN),  error  time 
histories  for  each  Monte  Carlo  were  stored.  These  data  form  the 
input  for  the  third  job  step. 

The  third  job  step  propagates  the  stored  6 A.  cos  6 $ , 6VE  and 
6Vn  through  the  updating  model  (20  Monte  Carlos)  forming  the  RMS 
response  and  also  generates  the  RMS  updated  response  of  20  Monte 
Carlos  of  the  radio  error.  These  data  are  stored  and  finally 
RSS'd  to  give  the  radio-inertial  RMS  response  for  twenty  Monte 

Carlos . 

The  generation  of  separate  updated  responses  for  the  radio  and 
inertial  error  provided  comparative  data  for  the  rational  selec- 
tion of  the  gains  used  in  the  updating  scheme. 
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5.2.8  Performance  of  Inertial  Budget  #5 

The  inertial  error  budget  given  in  table  5-5  (005)  was  used  to 
obtain  the  results  presented  in  this  section.  Figures  5-36  to 
5-40  summarize  the  free  inertial  error  responses  and  figures  5-41 
to  5—46  summarize  the  radio-inertial  residual  error  responses. 
Since  the  error  estimation  and  updating  process  is  performed  open 
loop  and  involves  only  position  and  velocity,  the  heading,  pitch 
and  roll  error  responses  (figures  5-38,  -39  and  -40)  are  invariant 
to  the  updating. 

The  gains  used  for  the  updating  were  "tuned"  for  Error  Budget  #5 
and  are 

Kx  = 3.24  x 10-2  m/m  (5.2-30) 

-4 

Ky  = 3.65  x 10  m/sec/m  (5.2-31) 

The  updating  occurred  every  5 seconds  starting  at  605  seconds 
except  for  three  periods  where  the  loss  of  updating  for  sixty 
seconds  was  simulated.  These  periods  are  shown  in  table  5-6. 


TABLE  5-6.  UPDATE  LOSS  PERIODS 


SEC 

HOURS 

1920  - 1980 
2900  - 2960 
4140  - 4200 

0.533  - 0.550 
0.806  - 0.822 
1.150  - 1.167 

These  periods  occur  just  prior  to  landing  and  are  meant  to  simu- 
late the  possible  loss  of  the  radio  signal  by  shadowing  effects 
due  to  the  low  altitude  of  the  vehicle. 

The  characteristics  of  the  RMS  free  inertial  responses  are  highly 
sensitive  to  the  particular  aircraft  maneuvering.  This  is  ob- 
vious in  the  velocity,  heading,  pitch  and  roll  responses  (fig- 
ures 5-36,  -38,  -39  and  -40).  Each  time  the  aircraft  changes 
heading  the  velocity  error  is  seen  to  abruptly  change  slope 
principally  due  to  the  geographic  rotation  of  the  gyro  and 
accelerometer  biases.  Table  7 summarizes  the  free  inertial 
performance  for  Budget  #5. 
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STRAPDOWN  FREE  INERTIAL:  TRAJECTORY  » TRAJ002  (HOME  LAT=45DEG) 
LANGLEY  ERROR  BUDGET  005  20  MONTE  CARLOS 

Figure  5-38.  Heading  Error  (Budget  #5) 
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TIME  (HOURS) 

STRAPDOWN,  RADIO  UPDATED:  TRAJECTORY-TRAJ002  (HOME  LAT=45DEG) 

LANGLEY  005.  RADIO  001,  UPDATE  004,  20  MONTE  CARLOS 


Figure  5-41.  Radio-Inertial  East  Position  Error 
Residual  (Budget  #5) 
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STRAPDOWN,  RADIO  UPDATED:  TRAJECTORY  = TRAJ002  (HOME  LAT  = 45  DEG) 
LANGLEY  005,  RADIO  001,  UPDATE  004,  20  MONTE  CARLOS 


Figure  5-43.  Radio-Inertial  CEP  Residual  (Budget  #5) 
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STRAPDOWN,  RADIO  UPDATED:  TRAJECT0RY-TRAJ002  (HOME  LAT-45DEG) 
LANGLEY  005,  RADIO  001,  UPDATE  004.  20  MONTE  CARLOS 


Figure  5-45.  Radio-Inertial  North  Velocity 
Error  Residual  (Budget  #5) 
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TABLE  5-7.  FREE  INERTIAL  SUMMARY 
PERFORMANCE  (BUDGET  #5) 


Position 

5.6  Km  /hr  CEP 

Velocity 

2.7  m/sec  CEV 

Heading 

6 min  + 8 min/hr  RMS 

Pitch 

0.4  min  + 1 min/hr  RMS 

Roll 

0 . 2 min  + 1 min/hr  RMS 

Utilization  of  the  radio  information  to  estimate  the  position 
and  velocity  error  considerably  improves  the  error  profiles. 

The  position  error  (figures  5-41,  -42,  and  -43)  indicates  about 
a 73  m error  CEP  with  a small  (43  m/hr)  increasing  slope.  The 
three  update  outage  periods  coincide  with  the  270°  turns  before 
landing  and  can  be  identified  by  30  m (approximately)  error 
spikes  in  the  curves.  If  updating  had  continued  these  spikes 
would  have  been  considerably  reduced  in  size  because  of  the  tight 
coupling  to  the  radio  position. 

The  velocity  error  (figures  5-44,  -45,  -46)  indicates  a CEV  of 
approximately  0.53  m/sec  (somewhat  lower  at  the  beginning  of  the 
flight).  Since  the  update  outages  coincide  with  the  270°  turns 
before  landing  it  is  not  clear  from  the  data  presented  whether 
the  spikes  seen  at  these  times  are  due  primarily  to  the  existing 
attitude  and  heading  errors  or  the  outage  itself . Simulation 
analysis  on  Error  Budget  #4  indicates  that  little  improvement  in 
the  velocity  performance  is  obtained  by  eliminating  the  outages 
and  therefore  the  spikes  are  primarily  due  to  attitude  and  heading 
errors.  It  is  concluded  therefore  that  the  same  is  true  for 
Error  Budget  #5 . 

5.2.9  Performance  of  Inertial  Budget  #4 

The  inertial  error  budget  given  in  table  5-4  (004)  was  used  to 
obtain  the  results  presented  in  this  section.  Figures  5-47  to 
5-51  summarize  the  free  inertial  error  responses  and  figures  5-52 
to  5-57  summarize  the  radio-inertial  residual  error  responses. 

As  mentioned  in  paragraph  5.2.8,  the  heading,  pitch  and  roll 
error  responses  (figures  5-49,  -50,  and  -51)  are  invariant  to  the 
updating. 
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STRAPDOWN,  RADIO  UPDATED:  TRAJECTORY  TRAJ002  (HOME  LAT  = 45  DEG) 
LANGLEY  004,  RADIO  001,  UPDATE  005.  20  MONTE  CARLOS 


Figure  5-54.  Radio-Inertial  CEP  Residual  (Budget  #4) 
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The  gains  used  for 
and  are 


the  updating  were  "tuned" 
_2 

K = 4.25  x 10  m/m 

X 

K = 6.31  x 10-4  m/sec/m 
v 


for  Error  Budget  #4 


(5.2-32) 

(5.2-33) 


The  updating  times  for  this  simulation  are  exactly  the  same  as 
those  used  for  Error  Budget  #5,  inclusive  of  the  loss  of  up- 
dating (see  paragraph  5.2.8,  table  5-6). 


Compared  to  Error  Budget  #5,  the  free  inertial  error  responses 
for  Error  Budget  #4  are  considerably  larger.  The  large  varia- 
tions of  the  velocity,  pitch  and  roll  error  responses  make  it 
difficult  to  characterize  the  free  inertial  performance  as  was 
done  for  Error  Budget  #5  (see  table  5-7).  Because  of  the  large 
gyro  drifts  the  heading  error  incurred  at  alignment  (due  to 
equivalent  east  gyro  drift  rate)  remains  the  heading  error  for 
the  entire  flight  for  all  practical  purposes.  From  the  CEP  plot 
(figure  5-47)  the  free  inertial  performance  can  be  characterized 

as  14.8  km/hr  CEP. 


As  for  Error  Budget  #5  the  radio  updating  improves  the  error  pro- 
files.  The  position  errors  (figures  5-52,  -53,  and  -54)  indicate 
about  an  82  m CEP  with  a small  (~43  m/hr)  increasing  slope.  Com- 
pared to  Error  Budget  #5  the  responses  are  considerably  less 
smooth.  The  various  large  spikes  occurring  can  be  correlate 
with  the  heading  changes  of  the  aircraft.  An  additional  Simula 
tion  made  (but  not  included  herein)  shows  that  the  spikes 
occurring  when  the  aircraft  turns  and  simultaneously  experiences 
an  update  outage  are  considerably  reduced  if  the  updating  had 
continued.  This  is  because  of  the  tight  coupling  to  the  radio 
position . 

The  velocity  error  (figures  5-55,  -56,  and  -57)  indicates  a CEV 
of  approximately  0.8  m/sec.  As  for  position  the  various  large 
spikes  can  be  correlated  with  the  heading  changes  of  the  air- 
craft. Eliminating  the  update  outages  changes  the  performance 
very  little  during  these  periods.  Thus  the  velocity  performance 
is  practically  independent  of  the  outages  simulated.  The  spikes 
can  be  related  to  the  heading  error  at  the  time  of  the  turn. 

For  example,  the  90°  turn  at  0.28  hours  requires  a velocity 
change  of 


AV_  = 69  m/sec  (5.2-34) 

£ 

AV„,  = 0 m/sec  (5.2-35) 

N 
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therefore  it  would  be  expected  that  the  east  velocity  error  would 
not  be  affected  and  that  the  north  velocity  error  would  increase 
by  the  heading  error  (40  min)  times  the  east  velocity  change,  that 
is  0.7  m/sec.  From  figure  5-55  and  -56  it  is  seen  that  this  is 
what  happened. 

One  important  consideration  relative  to  the  observed  velocity 
error  spikes  is  the  time  required  to  recover  from  them  especially 
at  the  time  of  landing.  From  the  graphs  it  is  estimated  that 
the  recovery  time  is  one  to  two  minutes. 

5.2.10  Conclusions 

The  Langley  velocity  error  specification  is 

1.03  m/sec  radial  95% 
or  in  terms  of  50%  radial  (CEV) 

0.49  m/sec  CEV 

Error  Budget  #5  is  estimated  to  be  slightly  above  the  specifica- 
tion. However  it  is  observed  that  the  performance  from  initial 
takeoff  to  the  first  landing  is  within  specification.  Since  the 
simulation  did  not  take  advantage  of  the  time  period  on  the 
ground  to  realign,  it  is  anticipated  that  such  a procedure  would 
improve  the  overall  performance  to  that  seen  in  the  first  air- 
borne period.  As  mentioned  previously,  the  velocity  performance 
is  highly  uncorrelated  to  the  update  outage.  Therefore  further 
improvement  in  performance  requires  a somewhat  more  sophisticated 
err<pr  estimator . In  particular  it  is  anticipated  that  including 
attitude  and  heading  in  the  error  estimator  would  bring  the 
velocity  well  within  the  specification.  Some  form  of  simple 
Kalman  filter  would  probably  be  required. 

Error  Budget  #4  is  not  within  specification.  The  comments  for 
Budget  #5  relative  to  performance  improvement  are  equally  appli- 
cable for  Error  Budget  #4.  In  addition  it  might  be  necessary  to 
incorporate  some  form  of  gyro  biasing. 

5 . 3 System  Reliability 

5.3.1  Analytical  Approach 

System  reliability  is  expressed  in  terms  of  the  probability  of 
a complete  system  failure  to  produce  required  outputs,  for  a half- 
hour  flight  duration.  The  failure  probability  calculation  is 
based  upon  the  selected  system  mechanization,  and  predicted 
component  failure  rates.  The  predicted  failure  rate  and  hardware 
MTBF  are  derived  in  Appendix  G and  are  based  on  a preliminary  list 
of  electronic  components  for  the  redundant  strapdown  INS. 
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The  definition  of  a failure  depends  upon  the  manner  in  which 
system  outputs  are  used.  Two  levels  of  system  performance 
"failure"  are  defined,  one  relative  to  navigation  data  failures 
and  the  other  relative  to  flight  control  system  failures.  The 
former  requirement  is  generally  less  stringent  since  other  naviga- 
tion data  such  as  radio  aids , ground  radar , or  visual  sighting 
are  generally  available.  Reliability  requirements  for  the  latter, 
however,  are  very  stringent  since  aircraft  safety  is  affected. 


To  facilitate  discussions  of  system  reliability  we  define  differ- 
ent levels  of  gyro  drift  (D)  failure  as  follows: 


Hard  Failure  - The  channel  of  the  gyro  is  non-functional. 

The  failure  may  be  detected  and  isolated  to  a 
channel  by  self-contained  self  test. 


GF 


3 


GF 


2 


- The  gyro  has  drift  rate  exceeding  the  require- 
ment D„  for  attitude  rate  reference. 

ri 

- The  gyro  failure  has  drift  rate  less  than  GF3 


but  exceeding  the  requirement  D 
gat ion , 


min 


for  navi- 


GF^  - Gyro  drift  rate  less  than  Dmin  but  more  than 

three  times  the  specified  gyro  drift  rate. 


Considering  the  total  population  of  failures  which  might  occur 
over  a long  period  of  time , there  will  be  a distribution  of 
failures  into  these  various  categories.  Since  precise  data  are 
lacking  on  this  distribution,  a set  of  assumptions  has  been  made, 
as  shown  in  figure  5-58. 

The  assumptions  of  Dmin  = 1 °/hr  and  Djj  = l°/sec  are  preliminary, 
as  described  in  paragraph  4.4.9.  An  angular  threshold  for  large 
drift  errors  of  1 arc  minute  is  also  assumed.  These  detection 
levels  cannot  be  used  during  aircraft  maneuvering  since  normal 
scale  factor  and  misalignment  tolerances  can  produce  errors  of 
this  magnitude  for  short  periods  of  time.  The  means  of  account- 
ing for  these  effects,  such  as  maneuver -dependent  limits  or 
dynamic  compensation,  have  not  been  defined  at  this  time. 


A higher  probability  has  been  assigned  to  the  region  of  small 
drifts  since  there  are  many  more  mechanisms  contributing  to 
slight  performance  degradations. 


It  is  further  assumed  that  the  vector  angle  of  a failure  drift 
is  constant  and  that  the  angle  of  a failure  has  a uniform  pro- 
bability density  over  360°.  This  is  also  a very  conservative 
assumption  since  the  angle  will  vary  in  many  cases  due  to  erratic 
performance  or  aircraft  maneuvering.  In  either  case,  the  3- 
gyro  isolation  ambiguity  will  be  avoided  if  the  failure  occurs 
as  a second  failure.  To  be  conservative,  the  increase  of  prob- 
ability density  in  the  area  of  gyro  input  axes  is  ignored. 
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• 50%  OF  GYRO  FAILURES  ARE  DETECTED  BY  SELF-TEST. 

• DISTRIBUTION  OF  GYRO  FAILURES  WITH  AMPLITUDES  IS  SHOWN  ABOVE. 

• DISTRIBUTION  OF  SOFT  GYRO  FAILURES  WITH  ANGLE  IS  UNIFORM  AND  INDEPENDENT 
OF  AMPLITUDE 

• EXTERNAL  AVIONICS  CAN  DETECT.  ISOLATE,  AND  RECONFIGURE  FROM  TWO  INU„c  I/O 

FAILURES  WITH  UNITY  COVERAGE  * 

• HARDWARE  FDI  OF  INUoc  SOFTWARE  INTERRUPT  HAS  UNITY  COVERAGE  FOR  TWO 
FAILURES 

• THE  INTER-COMPUTER  I/O  DOES  NOT  HAVE  MULTI-CHANNEL  FAILURE  MODES 


Figure  5-58. 


Assumptions  Used 


in  System  Reliability  Analysis 
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The  ultimate  use  of  redundant  strapdown  INU  (INUrsV  data  will 
require  a final  vote  on  the  four  channel  outputs  to  be  performed 
in  order  to  derive  a single  activity,  such  as  a display  of  naviga- 
tion data,  or  to  drive  flight  control  actuators.  The  INURS 
reliability  calculation  assumes  this  final  vote  is  performed  with 
unity  coverage  for  two  failures. 

The  preliminary  design  described  herein  has  not  included  hardware 
design  such  as  for  the  inter— channel  data  transfer  and  synchroniza- 
tion of  the  four  software  executive  interrupts.  It  is  assumed 
that  these  hardware  designs  do  not  detract  from  coverage  of  two 
failures . 

The  reliability  diagram  for  a single  channel  is  illustrated  in 
figure  5—59.  The  main  failure  rates,  indicated  in  failures  per 
million  hours,  reflect  a channel  MTBF  of  about  4000  hours.  The 
failure  rates  in  parentheses  are  for  a 2000  hour  MTBF , degraded 
due  to  exposure  to  a more  severe  environment.  A summary  of  mod- 
ule failure  rates,  extracted  from  Appendix  G,  is  shown  in  fig- 
ure 5-60. 

The  system  failure  probability  is  calculated  for  each  of  the 
failure  rates  and  for  two  failure  detection  levels,  Dr  and  D^n, 
representing  flight  control  and  navigation  degradation,  respec- 
tively. The  failure  detection  amplitude  determines  the  probability 
that  a given  second  soft  gyro  failure  results  in  failure— isolation 
ambiguity  and  complete  system  failure.  In  practice,  this  con- 
dition can  be  remedied  by  reference  to  radio  updates,  or  by  pilot 
intervention,  however,  these  possibilities  are  not  assumed  for 
the  failure  probability  calculation. 

Several  system  architectures  have  been  assumed  for  trade-off 
purposes.  They  are: 

a.  Flexible  IMM-to-computer  I/O  (a  computer  can  receive  all 
sensor  data  with  all  other  computers  in  a failed  con- 
dition) with  full  accelerometer  selection  flexibility 
(the  alternate  I/O  path  shown  in  figure  5-59). 

b.  Same  as  above  but  with  both  accelerometers  of  a channel 
rejected  if  one  fails. 

c.  IMM  data  input  to  only  one  computer  ( cross -channel  com- 
parison after  computer  processing  of  figure  5-59  only) 
and  inflexible  accelerometer  processing. 

Option  c is  the  selected  mechanization.  Options  a and  b are 
included  for  trade-off  purposes,  and  may  be  applicable  to 
missions  with  longer  flight  duration. 

Paragraph  5.3.2  describes  the  flight  control  failure  probabilities 
( sensor— related) , and  5.3.3  describes  navigation  failure  prob- 
abilities for  the  various  mechanizations,  MTBF ' s , and  flight 
duration . 
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Figure  5-59.  Single-Channel  Reliability  Diagram 

An  advanced  method  of  FDI  has  been  formulated  using  the  parity 
equations  derived  in  Appendix  B.  This  algorithm  would  be  used 
in  conjunction  with  the  simple  table  look-up  approach  for  improved 
FDI  sensitivity  and  for  reduced  INS  error  buildup  just  prior  to 
redundancy  management  reconfiguration.  Further  work  is  required 
to  consider  effects  of  normal  scale  factor  error,  etc.  Present 
work  on  the  advanced  FDI  method  is  presented  in  Appendix  I and  is 
summarized  in  paragraph  5.3.4. 

5-3.2  Probability  of  Flight  Control  System  Output  Failure 

The  attitude  rate  measurement  functions  of  the  redundant  strap- 
down  INS  are  regarded  as  failed  if  an  attitude  rate  measurement 
has  an  error  with  a magnitude  DH , where  DH  = l.°/sec.  To  mini- 
mize the  probability  of  attitude  rate  failure  the  software  should 
select  gyro  pair  channels  (in  the  event  of  three  failures  includ- 
ing GF 2 type,  or  two  gyro  failures  including  a GF2  type  with  an 
ambiguity)  so  as  to  accept  as  valid  any  GF2  failed  gyros.  Use 
of  SDF  accelerometers  precludes  accelerometer  FDI  ambiguity  so 
it  is  assumed  that  coverage  of  these  failures  is  unity. 


224 


403314 


ro  ro 
00 
o 

if) 


CT)  0 
CO  O 
^ •— 

CvJ 

CO 

DC 

X 

CD 

O 


LU 

H co 

< oc 

X 3 


UJ  LU 

z z 


< < 

X X 

a o 


Cm 

CQ 

2 


G 

rtf 


CD 

4J 

m 

Ph 


0) 

u 

p 


*H 

rtf 

Cm 


CD 

G 

G 

m 

x 

u 

TJ 

CD 

3 

rtf 

H 

a 

u 


rtf 

U 


O 

U3 

I 

in 

0) 

3 

cn 

■ H 
Cm 


225 


403314 


flexibility^sT*  °f  failUre  “ith  £ul1  I«M-t°-computer  I/O 


p * (>)  p" ' v * @p " - v‘H  * 11  ■ 'M!,  * (!)'. 

$ 


fg  ,2c 

*3 


♦ f u-nJ 

p p 


,f-  U'V  pa  y3 


♦ |U  - f ) ♦ 

*3 


(?)'.,  \y3'l Hl|* " • y4  k ♦ • 0 K * u - v j| 


where,  for  fully  flexible  accelerometer  logic, 
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fp»  fc,  and  fa  are  the  power  supply,  computer  (and  I/O) , and 
accelerometer  failure  probabilities  based  on  their  ),  from  fiq- 
ure  5-59  times  10b,  times  flight  duration;  fg3  is  the  probability 
gyro  failure  drift  greater  than  DH  including  the  failure  versus 
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amplitude  distribution  of  figure  5-58,  and  approximately  0.5 
times  the  gyro  A.  of  figure  5-59,  times  10  , times  flight  duration, 
yi  is  the  portion  of  gyro  failures  with  amplitude  greater  than 
Dh  and  not  detected  by  self-test  which  are  subject  to  failure 
isolation  ambiguity.  That  is,  from  figure  5-58,  y3  ~ 0.25. 

P is  the  probability  that  a given  soft  second  gyro  failure 

falls  into  a fault-isolation  ambiguity.  Assuming  a uniform 
distribution  of  failure  angles  over  360° , and  a Dmax  of 
3.6  x 105o/hr, 


C 


TT 


1.26  ON 
(°maxH  “ °h) 


In 


(DmaxH/DH) 


where  on  is  the  noise  level.  For  ON  - 0.1°/hr, 


(6) 


1.26  (0.1)  4.6 
0.36  x 10b 


= 1 . 6 x 10 


-6 


If  two  gyro  failures  occur  simultaneously,  and  are  of  comparable 
amplitudes  with  certain  failure  directions,  FDI  ambiguity  may 
occur.  (Described  in  Appendix  J.)  The  probability  of  simul- 
taneous failures  during  a 0.5  hour  mission  is  a function  of  the 
time  to  detect  errors  greater  than  Du*  If  the  detection  level 
is  set  to  1 min,  time  to  detect  an  error  of  l°/second  is  1/60  sec- 
ond. Probability  of  simultaneous  failures  in  a half-hour  flight 
is  then  10~5.  The  probability  of  two  gyro  failures  not  detectable 
by  self-test  being  greater  than  Dh  is  (0.5  x fg^)2  = 2 x 10“l0. 

Of  such  cases,  from  Appendix  J,  only  the  small  fraction 
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cause  failure.  The  combination  of  these  three  probabilities 
is  10-21  which  is  negligible. 

If  accelerometers  are  rejected  in  pairs  instead  of  a fully- 
f lexible  choice,  the  following  terms  apply: 


G = 


1 - 


(1  - 


(8) 
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If  I MM- to- computer  I/O  is  made  inflexible,  that  is  a computer 
can  only  read  other  channel  data  through  their  computer,  and 
inflexible  accelerometer  selection  is  assumed  system  failure 
probability  becomes: 


" U ‘ fpc’4  [x3  + (1  - X3)  J ] 111) 

where  fg3,  X3 , and  y3  are  as  previously  defined,  G,  H,  and  J are 
those  definitions  for  inflexible  accelerometer  selection,  equa- 
tions (8),  (9),  and  (10),  and 

fpc  - [l  - U - V <1  - fc>] 
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The  terms  of  equations  (1)  and  (11)  represent  the  various  system 
failure  modes.  Thus,  the  first  term  applies  to  four  power 
supply  failures  during  the  flight.  The  second  term  indicates 
three  power  supply  (or  computer,  for  equation  (ID)  failures. 

The  third  term  is  for  two  power  supply  failures  plus  an  addi- 
tional failure  such  as  a gyro. 


Evaluation  of  equation  (1)  with  and  without  flexible  accelerometer 
selection  and  equation  (11)  without  flexible  accelerometer 
selection  for  the  two  system  MTBF ' s and  for  different  flight 
durations  leads  to  system  failure  probabilities  shown  in 
table  5-8. 


TABLE  5-8.  FLIGHT  CONTROL  OUTPUT  FAILURE 
PROBABILITY  VERSUS  ARCHITECTURE, 

FLIGHT  TIME,  AND  CHANNEL  MTBF 


ARCHITECTURE 

FLIGHT 
TIME  (HR) 

MTBF 

4000  HR 

2000  HR 

0.5 

1.1  x 10"13 

-12 

1.3  x 10 

FULL  FLEXIBILITY 

1.0 

8.7  x 10"13 

1.0  x 10-11 

8.0 

4.4  x 10  38 

5.1  x 10  8 

0.5 

-13 

4.1  x 10 

-12 

3.5  x 10 

INFLEXIBLE  ACCELS . 

1.0 

-12 

3.3  x 10 

2.8  x lO-33 

8.0 

-9 

1.7  x 10 

1.5  x 10“8 

0.5 

-12 

4.5  x 10 

4.7  x 10-11 

INFLEXIBLE  I/O 

1.0 

3.6  x 10-11 

3.8  x 10  38 

8.0 

1.9  x 10‘8 

1.9  x 10"7 

The  following  conclusions  may  then  be  drawn: 

a.  All  architectures  meet  the  required  10  8 failure 
probability  for  0.5  hour  flights. 

b.  Full  flexibility  in  computer  instrument  selection  leads 
to  about  1/40  of  the  failure  probability  of  the  most 
inflexible  architecture. 
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d. 


e. 


Rejecting  accelerometers  in  pairs  results  in  about 

4 thS  failure  Probability  of  the  full  flexibility 

method.  J 

If  channel  MTBF  is  halved,  failure  probability  increases 
by  about  a factor  of  10. 

Applications  of  long  flight  durations  would  probably 
require  the  more  flexible  architecture. 

Probability  of  Navigation  Output  Failure 

The  probability  of  system  failure  for  navigation  outputs  has  the 
same  form  as  equation  (1)  except  that  the  full  distribution  of 
gyro  failures  with  amplitude  applies.  The  equation  then  becomes: 


<*<■  - .i2 

P P 


r + ( i - f 


t (i  - f r 
p p 


i + ( i - f 
c 


w,  *(i) 

*■  i «’  * (’)£  «>■'.* -(O*. 


f U - £ ) + (1  - f ) G 

>8  8 


“ - f > pA  y 


0 

i"-'. ,5  *(;)'« " -'« ,2"  -p*  y>  iHi|*"  ■'/!<*" -'.‘i  |x  *d  - x u| 


(12) 

where  fp,  t and  f are  as  previously  defined  and  G,  H,  and  J 

^mde5inedJln  ec3ua?ions  (3),  and  (4),  or  (8),  (9),  and 

(10) , depending  on  accelerometer  rejection  logic.  y is  essentiallv 

equal  to  y3  (0.25),  for  the  assumed  distribution,  and  SSSentially 


X = 


f4  + 


(3) 


a - * > 


(!) 


(1  - f ) 


(13) 


Evaluation  of  E>a  primarily  involves  the  failure  distribution, 
rom  figure  5 58,  from  1 to  20°/hr.  Using  these  values  in 

pqUi  o?0195.  f°r  Dmin  and  Dmax'  resPectively»  Yields 
A 

The  average  time  to  detect  errors  under  20°/hr  is  30  seconds  (for 
minimum  drift  of  l°/hr  and  a detection  level  of  1 arc  minute) 

ise30/18001-1nyn?fi7tW°rnKimUltKneOUS  failures  in  a 0.5  hour  flight 
a 30/1800  - 0.0167.  The  probability  of  two  GF2  failures  not  ^ 

detectable  by  self-test  is  (0.25  x fg)2  = 2 x 10-10.  0f  such 
cases  only  the  fraction,  from  equation  (7).  0.025,  apply.  The 
net  probability,  0.0167  x 2 x 0.025  x 10"l6  = 10-i3 
insignificant.  ' 
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The  equation  for  probability  of  navigation  output  failure  with 
the  inflexible  architecture,  similar  to  equation  (11),  is. 


P 


F 


fpcJ 


f (1  - f ) + (1 

g 9 


V 


2 


+ 


+ 


+ (1  - f ) 

pc 


X + (i  - x)  J 


(14) 


Using  the  previously  defined  values  of  G, 
(9),  and  (10)),  and  X (equation  (13)),  fpC 
y and  P^,  equation  (14)  may  be  evaluated 
MTBF , as  shown  in  table  5-9. 


H,  and  J (equations  (8) 
and  computed  values  of 
for  the  two  values  of 


TABLE  5-9.  NAVIGATION  OUTPUT  FAILURE  PROBABILITY 
VERSUS  FLIGHT  TIME  AND  CHANNEL  MTBF , 
INFLEXIBLE  ARCHITECTURE 


FLIGHT  TIME 

MTBF 

4000  HR 

2000  HR 

0.5 

1.3  x 10“10 

4.6  x 10_1° 

1.0 

5. 2 x 10~10 

1.8  x 10-9 

8.0 

3.3  x 10“8 

1.2  x 10-7 
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The  improvement  to  be  gained  by  using  the  more  flexible  I/O  and 
accelerometer  selection  architecture  is  not  as  great  for  naviga- 
tion output  reliability.  it  can  be  shown  to  be  less  than  a 
factor  of  3.  The  reason  this  occurs  is  that  the  probability  of 
isolation  ambiguity  is  much  more  significant  for  the  smaller 
gy^"^  drifts  needed  for  navigation  than  for  flight  control  failure 
detection  levels. 


5.3.4  Summary  of  Study  Results  in  Advanced  Technigues  for 
Failure  Detection  and  Isolation 

The  navigation  system  will  fail  if  errors  in  craft  rate  exceed 
l.°/hr  during  flights  where  craft  rates  of  >10.°/sec  = 3.6  x 104o/hr 
can  occur.  Failure  detection  and  isolation  techniques  based  on 
comparison  of  gyro  torquer  outputs  should  correspond  to  the  same 

directions to  within  a fraction  of  l°/hr/3.6  x 104o/hr  ~ 0.3  x 10-4 

rad  — 6.  sec.  For  this  reason,  directions  in  which  angular  rate 
is  sensed  by  more  than  one  gyro  are  important  for  comparative 
testing.  For  the  tetrahedral  array  the  sensing  planes  of  only  two 
gyros  intersect  in  the  same  direction.  Each  intersection  is  at 
an  edge  of  the  tetrahedron  defining  a test  direction  along  the 
edge  for  a comparison  of  components  of  observed  angular  rate 
obtained  by  resolution  of  the  two  torquer  outputs  of  each  gyro. 

Each  difference  of  angular  rate  components  Trs  of  gyro  r and 
gyro  s along  the  commonly  sensed  direction  of  a tetrahedron 
edge,  is  a member  of  the  set  of  six  edge  test  observations. 


12'  13' 


14' 


23'  24 


34 


which  comprise  the  primary  information  of  angular  rate  outputs  of 
the  gyros.  The  computation  and  smoothing  of  Trs  quantities  is 
described  in  Appendix  B.  The  analysis  of  Appendix  I evolves 
advanced  techniques  for  failure  detection  and  isolation.  The 
study  first  seeks  an  answer  to  the  question  of  what  test  functions 
Fg  of  contemporaneous  Trs, 


F 

g 


(T 


12  ' 


13'  x14 


23 


24 


T ) 
34' 


g = 1,2, 3, 4 


give  a measure  of  whether  gyro  g has  failed?  More  general  func- 
tions could  involve  past  and  present  T^s  but  here  the  dependence 
on  past  Trs  is  limited  to  previous  decisions  regarding  gyro  fail- 
ure based  on  past  Trs  magnitudes.  Say  gyro  g was  previously 
isolated  as  failed.  Then  the  new  question  is,  what  functions 
Fg(g)  not  involving  the  failed  gyro  g,  where  for  example  g^  = 4 , 
and  we  have 


F 

g 


(4) 


(T 


12'  1 1 3 ' 


t23) 


g = 1,2,3 


give  a measure  of  whether  gyro  g has  failed? 
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To  facilitate  the  generation  of  gyro  failure  isolation  functions 
Fg  for  the  four  gyro  case  and  Fg(g)  for  the  three  gyro  case,  we 
directly  implement  a definition  of  failure  of  a gyro  according 
to  total  drift  rate  in  the  sensing  plane,  a failed  gyro  corres- 
ponding to 


D 

g 


D 

g 


> 


e 


2 


where  c is  a test  drift  rate  level.  Derived  functions  may  be 
directly  used  or,  as  in  the  three  gyro  case,  an  equivalent  form 
of  the  functions  is  shown  to  involve  simplified  testing. 

A second  criterion  to  facilitate  the  generation  of  test  functions 
is  the  assumption  that  only  one  gyro  has  failed  in  the  test  period. 
In  the  three  gyro  case  this  criterion  is  not  a limitation  since 
two  gyro  failures  means  certain  navigation  system  failure.  In 
the  four  gyro  case,  once  deriving  the  implied  functions  Fg,  it  is 
necessary  to  provide  special  secondary  procedures  for  the  infre- 
quent situation  of  two  gyros  failing  within  the  test  smoothing 
time  (see  Appendix  J) . The  frequency  and  provision  for  such 
cases  are  analyzed  in  another  section. 

In  the  four  gyro  case  it  is  shown  in  Appendix  I— 1 that  if  a single 
gyro  g failed  with  drift  rate  Dp§  then  functions  Fg  [g  = 1...4] 
given  by  (6a),  (6b)  take  on  the  values,  in  the  absence  of  noise, 

2 g 


where 

6 


g _ ( 1 if  g = g 

g ( 0 otherwise 


Gyro  failure  detection  and  isolation  is  given  by  failure  of  the 
test  Fg  < [g  = 1...4). 

An  equivalent  form  of  F [g  = 1...4]  defined  by  (6a),  (6b), 

Appendix  I is 


F_  = ^ 


iFo  - F(<5>i 
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where 


F ( 1 ) 
F(2) 
F ( 3 ) 
F ( 4 ) 


_ 2 

™ 2 

2 

T2  3 

+ 

T 

24 

+ 

T 

34 

+ 

(T23 

T 

24 
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m 2 

2 

= T1 3 
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T14 

T 

34 

+ 
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12 
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34 

In  this  algebraic  form  the_calculation  of  test  functions  for 
four  gyros  make  functions  F(g)  available  for: 

a.  Special  procedures  for  detection  and  provision  for  two 
effectively  simultaneous  failures 

b.  Failure  detection  and  isolation  in  the  three  gyro  case. 
For  four  gyros  the  test  Fg  < £ can  be  made  equivalently  by  tests 


F(g)  > Fc  - | cf 


g = 1 ...  4 


as  indicated  in  the  preliminary  FORTRAN  list  of  the  advanced 
failure  detection  and  isolation  program  listed  in  Appendix  1-5. 
The  statistical  properties  of  the  four  gyro  test  procedure  in  the 
presence  of  gyro  noise  are  analyzed  in  some  detail  in  Appendix  I. 
The  fractional  variation  from  gyro  noise  of  F if  qyro  q failed 
is  9 ^ 


Fg  average  /y 


= 7?  r / 


1 + r 


r = 


N 

}Fg 


“1"““  °N  - 0-lVhr  and  Dpg  - Dp  . - l.»/hr  the  lo  varia- 
tion  of  Fg  from  noise  for  the  minimum  failure  rate  is  11  6%  if 
none  of  the  gyros  failed,  the  effect  of  gyro  noises  in  producing 
outputs  of  Fg  is  to  produce  lo  output  of  -.63%  to  +1.63%  of  that 
of  a minimally  failed  gyro  at  l.°/hr.  An  exact  probability 
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distribution*  for  Fq  from  noise  is  derived  from  which  the  false 
alarm  probability  PFA  for  test  level  is  shown  to  be 


PFA 


5 

7 


Four  Gyro  Case 


For  noise  level  — . l°/hr  and  test  level  c 


. 5 °/hr 


pfa  ■ 2 x 10 


for  which  the  fraction 


f of  false  alarms 


to  actual  failures  is 


f = -L2  • (MTBF) 
rFA  ts 


.5  x 10 


Four  Gyro  Case 


for  mean  time  before  failure  MTBF  = 3000  hr,  test  smoothing  time 
t =60.0  sec.  The  probability  of  non-detection  is  a more 
involved  calculation  and  necessarily  uses  approximations  good 
for  the  range  of  test  levels  considered.  Assuming  a relatively 
flat  distribution  of  failure  drift  rates  with  minimum  value 
Dp  ■ , the  probability  of  non-detection  at  the  recommended  failure 

test" level  c2 , with  e = ( 6N  + °Fmin ) /2  is 


X 

PND 

0 

N 

ii 

io-24 

9 

io-13 

8 

io-6 

7 

3 x 10-5 

* A modified  Rayleigh  distribution. 
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Techniques  were  evolved  for  evaluation  of  the  probability 
tribution  of  relevant  classes  of  test  functions.  Probabil 
distribution  is  requisite  to  determine  probability  of  rare 
such  as  false  alarm  and  non— detection . 


dis- 

ity 

events 


The  three- gyro  case  was  analyzed  to  obtain  test  functions  based 
on  the  same  criteria  of  failure  definition  and  single  failure  at 
a time,  obtaining  failure  detection  and  isolation  functions  for 
gyro  g where  gyro  g has  previously  failed. 


F < 
9 


2 

£ 


where 


Three  Gyro  Case 

Fg  - f l?(i>  -2k  • Trs2>  r S g / g 

where  F(g)  is  defined  for  the  four  gyro  case  above. 

It  is  shown  k > o should  be  as  high  as  tolerable  for  the  qyro 
noise  level,  yjr 


min 


for  test  decision  purposes,  despite  the  fact  that  other  smaller  K 
makes  Fg  a better  estimate  Dg2  when  the  other  gyros  are  drifting. 

The  tests  for  F < l2  to  determine  validity  of  each  gyro  g other 
tnan  gyro  g are  equivalent  to  failure  tests, 

_ Three  Gyro  Case 

Test  # g Trs2  > (F(g)  t2)/2K  r jt  s * g + g 


such  that  if  only  Test  #g  fails  then  gyro  g has  failed.  In  the 
event  two  of  the  three  tests  fail  we  have  the  ambiguous  case  in 
which  the  direction  of  the  failure  drift  is  near  normal  to  a test 
direction.  The  Test  #g  is  incorporated  in  the  preliminary 
FORTRAN  list  of  the  advanced  failure  detection  and  isolation  pro- 
gram listed  in  Appendix  1-5 , in  the  test  of  S(L)  E Trs2  against 
TL  - (F(g)  -3/2  c2)/2K.  In  the  ambiguous  case  where  two  of  the 
three  tests  fail,  it  is  known  that  one  gyro  g whose  test  passed 


236 


403314 


is  good.  To  find  which  gyro  failed,  gyro  r or  gyro  s,  the 
statistic 


A 


) 


is  analyzed  for  probability  distribution  given  gyro  r failed  or 
gyro  s failed  in  the  presence  of  gyro  noise.  From  these  probabil- 
ity distributions  are  derived  the  probability  that  gyro  r failed, 
Ppr(A).  Then  the  reliability  of  the  decision  of  which  gyro  failed 
is  calculable  in  terms  of  edge  test  observations.  Operational 
requirements  determine  the  use  of  decision  reliability,  for  example 
if  below  a prescribed  level  of  certainty  to  signal  to  the  pilot  a 
system  failure.  In  Appendix  1-5  a particular  utilization  of  the 
probability  of  correct  decision,  extracted  from  a stored  table  is 
considered,  namely,  the  assignment  of  gyro  validity 


v = 
r 


(A) 


for  weighting  of  navigation  channel  estimates  or  according  to  level 
for  logical  validity. 

It  is  proposed  that  improved  navigation  accuracy  with  four  valid 
gyros  be  obtained  by  weighting  channels  according  to  drift  level 
estimates  of  the  gyros  of  each  channel.  Soft  failures  GF^  which 
markedly  degrade  navigation  of  a channel  using  such  gyros  would  be 
downgraded  in  a weighting  of  channel  estimates  of  a variable  X, 


where 


S cuj  . Xj 
X - 


4 

2 Wj 

i = 1 


-1 


Channel  i uses 


Wi  = [2Fq  - F(r)  -F ( s ) + C]  gyro  r,  gyro  s 


Fo' 

and 


the  functions 
ure  detection  and  isolation  program 
ambiguous  two  gyros  are  of  interest 
example,  using 


F(r)  and  F(s)  being  available  from  the  gyro  fail- 

The  case  of  three  gyros  and 
for  weighted  navigation,  for 


= [T 


rs 


+ C] 


-1 


Channel 
gyro  r. 


i uses 
gyro  s 
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VI.  PRELIMINARY  SYSTEM  DESIGN 
6 . 1 System  Block  Diagrams 

A simplified  system  block  diagram  is  shown  in  figure  6-1.  The 
complete  redundant  strapdown  INS  is  composed  of  four  identical 
channels.  Each  channel  of  the  INS  consists  of  the  following 
elements : 

a.  An  Inertial  Measurement  Module  (IMM)  containing  the 
basic  inertial  sensing  devices,  one  TDF  tuned  gimbal 
gyro  and  two  axes  of  acceleration  measurement , with  their 
associated  electronics. 

b.  A computer  which  performs  redundancy  management,  instru- 
ment compensations,  coordinate  transformations,  and  the 
inertial  navigation  computations. 

c.  External  I/O  which  interfaces  the  computer  with  other 
aircraft  equipment.  Note  that  there  is  no  self-contained 
voting  in  the  system  between  the  computers  and  these  out- 
puts. The  external  equipment  must  perform  some  voting 
between  channels  (in  addition  to  using  validity  informa- 
tion provided  by  each  channel)  in  determining  the  final 
navigation  variable  to  be  used. 

cj  _ In  ter- computer  I/O  which  is  used  to  transfer  gyro  and 
accelerometer  measurement  data  from  one  channel  to  all 
others  for  use  in  redundancy  management,  and  for  deriva- 
tion of  the  full  3-dimensional  rate  and  acceleration 
inputs . 

e.  A power  supply  used  to  drive  all  elements  in  a channel. 
Note  that  there  is  no  cross— feeding  of  power  between 
channels.  This  results  in  a simple,  low-cost  power 
supply  design  with  a negligible  decrease  in  system 
reliability  over  a modularly  redundant  power  supply 
con  figuration. 

A more  detailed  block  diagram  for  one  of  the  four  Inertial  Naviga- 
tion Modules  (INM)  is  shown  in  figure  6-2.  The  equipment  shown 
is  packaged  in  its  own  chassis  and  four  of  these  chasses  installed 
into  a common  mount  comprise  the  complete  redundant  strapdown  INS. 
The  entire  system  will  have  a weight  of  28  kg  and  a power  consump- 
tion of  540  watts. 

6.2  Hardware  Design 

6.2.1  G-6  Gyro  and  Loop  Dynamics 

The  G-6  gyro,  figure  6-3,  consists  of  only  five  major  subassem- 
blies, resulting  in  a simple,  low-cost  design.  The  subassemblies 
are:  the  gyro  case,  bearing  assembly  capsule,  torquer  coils, 

Precedng  page  blank 
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Figure  6-2.  Inertial  Navigation  Module 
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Figure  6-3.  Photograph  of  Litton  G-6  Strapdown  INS  Gyroscope 
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Dickoffs  and  the  rotor  with  its  tuned  suspension.  The  torquer, 
pickoff,  and  bearing  subassemblies  are  mounted  in  the  case  con- 
taining the  spin  motor  stator.  The  replaceable  bearing  assembly 
contains  the  prealigned  shaft  and  bearing  assembly.  The  motor 
hysteresis  ring  is  mounted  on  one  end,  and  the  rotor  and  suspen- 
sion are  mountld  on  the  other.  End  covers,  when  soldered  in  place, 
provide  an  hermetic  seal  for  the  gyro.  All  five  major  subassem 
blies  are  interchangeable  with  other  like  subassemblies. 

The  Suspension  System 

The  function  of  the  suspension  system  is  to  provide  translational 
support  for  the  rotor  in  such  a way  that  the  effective  torsiona 
coupling  between  the  rotor  and  the  gyro  case  about  any  axis  that 
is  perpendicular  to  the  rotor  spin  axis  is  zero.  The  suspension 
system  in  a tuned  gyro  is  analogous  to  that  of  a universal  joint 
and  in  its  simplest  form  consists  of  an  inertia  element  (the  gim 
bal)  and  the  torsional  elements  (the  flexures).  Typically,  four 
cross-leaf  flexures  are  used.  Two  of  these  flexures  connect  the 
qimbal  to  the  shaft,  forming  one  torsion  axis  of  rotor  and  gim 
bal  freedom  relative  to  the  shaft.  The  remaining  two  flexures, 
whose  axis  of  torsion  is  orthogonal  to  that  established  by 
first  two  flexures,  connect  the  rotor  to  the  gimbal  an  us 
the  second  axis  of  rotor  freedom.  When  such  a ^pension  system 
and  the  rotor  are  run  at  a speed  corresponding  to  the  tuned  fre 
quency,  the  dynamically  induced  spring  rate  due  to  the  gimbal 
motion  is  equal  to  the  physical  spring  rate  of  the  flexures  and 
the  resultant  spring  rate  coupling  the  rotor  to  the  shaft  is  zero. 
This  condition  is  attained  by  the  adjustment  of  the  moments  of 
inertia  of  the  gimbal  such  that  the  tuned  frequency  is  equal  to 
the  frequency  of  the  synchronous  motor  speed. 

Through  careful  selection  of  the  ratio  of  rotor  to  gimbal  iner- 
tias and  gyro  operating  spin  speed,  Litton  has  eliminate 
for  complex  tuning  techniques  and  procedures  often  used  in  this 
class  of  instruments.  This  new  approach  not  only  significantly 
reduces  gyro  cost  but  also  inherently  enhances  performance. 

Reduced  long-term  mass  shifts  (spin  axis  mass  unbalance)  and 
tSernal  instability  of  mass  shifts  are  obtained  There  are  no 
adjustment  weights  on  the  rotor  assembly.  All  balancing  is  done 
at  the  subassembly  level  by  a static  balance  procedure  in  which 
unbalances  are  measured  and  appropriate  material  is  remove  . 

Gyro  tuning  is  also  adjusted  at  this  subassembly  level. 

References  [31],  [32],  and  [33]  provide  a description  of  the 

operation  and  errors  caused  by  the  tuned  suspension  system. 
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Torquers  and  Pickoffs 

Tlie  function  of  the  pickoffs  and  torquers  is  to  control  the  atti- 
u e of  the  rotor  relative  to  the  gyro  case.  When  an  input  rate 
is  applied  to  the  gyro  case,  the  case  fixed  pickoffs  sense  the 
change  of  rotor  attitude  relative  to  the  case  and  cause  the 
rebalance  loop  to  provide  current  to  the  torquers  in  sucha  sense 
as  to  reduce  this  change  to  zero.  in  an  ideal  strapdown  qyro  the 
torquer  maintains  the  spin  axis  of  the  rotor  aligned  with?the 
shaft  spin  axis  and  thus  the  rotor  has  the  same  angular  velocities 
as  the  case  about  the  input  axes.  The  torquers  art  designed  suc^ 

to  t^he  cur^ents  through  their  coils  are  directly  proportional 
to  the  moment  outputs  and  thus  the  torquer  current  is  ^direct 
measure  of  the  input  rate  to  the  gyro. 

The  gyro  torquer  is  a permanent  magnet  of  the  voice  coil  type  and 
is  capable  of  exerting  moments  on  the  rotor  about  two  nominally 
orthogonal  axes  that  are  perpendicular  to  the  rotor  spin  axis  Y 
The  torquer  consists  of  two  elements;  one  element  consists  of 
permanent  magnets  attached  to  the  rotor  and  thus  spinning  with 
the  rotor,  and  the  other  is  the  torquer  coil  assembly  fixed  to 
the  gyro  case.  The  permanent  magnets  are  radially  magnetized 
and,  when  assembled  on  the  rotor,  establish  a radially  oriented 

to?querCcoilid  aCr°SS  the  air9aP  containing  the  conductors  of  the 

• ^Ph-permeab 11  ity  rotor  Provides  the  return  path  for  the  mag- 
netic flux.  There  are  two  diametrically  opposite  torquer  coils 

ducedXb5  ferie?  in  SUGh  a Wa*  that  the  Aments  pro- 

duced by  the  individual  coils  are  additive.  The  average  torque 

produced  by  the  coils  is  proportional  to  the  product  of  the  effec- 

till  lenafh  ofS^y'  ampere  turns ' the  effective  circumferen- 

tial length  of  the  conductors  and  the  radius  of  the  airgap. 

The  pickoff  used  is  a high  frequency  variable  reluctance  type 
There  are  two  diametrically  opposite  E cores  per  axis,  each 
carrying  a primary  and  a secondary  winding.  The  reluctance  nath 
associated  with  each  core  consists  mainly  of  the  lirgap 
separates  the  E core  from  the  flux  return  path  mounted  on  the 
tor.  Thus,  the  field  set  up  by  the  primary  winding  and  linkinq 
the  secondary  winding  is  mainly  a function  of  the  airgap  length 
The  voltages  induced  m the  secondary  windings  of  thetSo  diamet- 
rically opposite  cores  are  connected  in  series-opposition.  The 
overall  pickoff  output  is  thus  only  sensitive  to  the  anqular 
motions  of  the  rotor  relative  to  the  case  about  the  pickoff  axis. 

Summary  of  Capture  Loop  Technique 

PulSe  rebalance  torquing  with  binary  duty  cycle  modulation  has 

?hS  f • y.Lltt°n  f°r  caPturin9  the  sensitive  elements  of 

the  inertial  instruments  (accelerometer  and  gyro).  Pul se-torquing 
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has  significant  advantages  in  terms  of  higher  accuracy,  less 
complexity,  higher  reliability,  and  lower  cost  than  other  methods 
considered.  Other  important  advantages  of  pulse  torquing  are  (1) 
elimination  of  torquer  nonlinearity,  (2)  constant  torquer  power 
dissipation,  and  (3)  elimination  of  linear  power  amplifiers. 

Each  axis  of  the  G-6  gyro  is  captured  using  a simple  single-axis 
loop,  i.e.,  the  X pickoff  drives  the  Y torquer,  and  the  Y pickoff 
drives  the  X torquer.  A major  disadvantage  in  using  a dual-axis 
approach  (i.e.,  what  is  recommended  in  reference  [3]  where  each 
torquer  is  controlled  by  both  pickoffs)  is  the  rectification 
effect  from  high  current  directed  into  the  torquers  at  harmonics 
of  the  spin  speed.  The  dual-axis  loop  has  relatively  high  gain 
at  frequencies  above  the  bandwidth  of  the  gyro  and  readily  couples 
the  everpresent  harmonic  noise  from  a pickoff  into  the  torquers. 
This  effect  is  compounded  by  the  fact  that  the  noise  from  both 
pickoffs  is  directed  into  each  torquer  at  high  gain  levels  (with 
considerably  more  circuitry  required) . 

The  single-axis  capture  loop  (using  a pure  lag  network  with  a 
notch  at  spin  speed)  attains  essentially  the  same  bandwidth  as 
the  dual-axis  but  reduces  the  torquer  noise  by  two  or  more  orders 
of  magnitude.  In  so  doing,  (1)  the  dynamic  range  is  not  degraded, 
(2)  torquer  rectification  effects  become  negligible,  (3)  the  gyro 
bias  is  insensitive  to  gain  variations,  and  (4)  much  shorter 
periods  of  time  are  required  to  ascertain  drift  rate  since  the 
data  channel  is  not  dithered  by  noise.  All  this  is  gained  simply , 
more  reliably,  and  at  lower  cost. 

The  predicted  performance  of  single-axis  control  using  pulse 
torquing  techniques  has  been  verified  by  tests  of  the  G-6  gyro. 


Gyro  Capture  Loop  Groundrules 

In  order  to  obtain  superior  performance  from  the  strapdown  system, 
any  significant  errors  generated  at  the  gyro  outputs  and  in  subse- 
quent computer  processing  must  be  minimized  or  compensated.  With 
this  in  mind,  certain  ground-rules  have  evolved  from  the  tests 
and  studies  of  various  capture  loops  for  dry  two-degree -of- freedom 
gyros.  These  investigations  have  contributed  to  optimizing  the 
significant  parameters  affecting  the  quality  of  the  gyro  output. 

Listed  below  are  some  of  the  critical  factors  which  have  been 
considered  in  the  design.  These  factors  are  especially  relevant 
with  regard  to  realizing  the  advantages  of  pulse-torquing. 

a.  The  noise  level  of  the  capture-loop  signals  which  are 

directed  into  the  pulse-torquing  networks  should  be  low. 
More  specifically,  both  the  noncoherent  and  spin-speed 
coherent  "noise"  levels  of  the  signal  which  controls  the 
pulse  widths  should  be  less  than  that  required  to  switch 
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from  one  discrete  pulse-width  level  to  the  next  This 
requirement  of  course,  is  a function  of  various ' factors 
including  bandwidth,  pulse  repetition  frequency,  and  Vhe 
pulse  modulation  frequency.  4 Y anQ  tfie 

b’  stabil??Id~o?°P^dYnaTiC  behavior  (bandwidth,  relative 

stability  etc.)  must  meet  conditions  which  are  comoati- 
ble  with  the  gyro  characteristics  as  well  as  V?th  the 

assSciaLdrS??hSin9wtr5hniqUeS-  F°r  instance'  errors 
should  Wlth.  P^koff  excursions,  even  if  compensated, 

minimized  by  insuring  that  the  bandwidth  is  as 
high  as  possible  without  unduly  exceeding  the  computer 
processing  rate.  Too  high  a bandwidth  may  torque  the  gyros 
unnecessarily  at  frequencies  which  will  not  be  processed 
ast  enough  by  the  computer,  and  consequently  the  error 
compensation  by  the  computer  would  become  ineffective? 

C‘  thlt^Vfr^^1119  resolution  should  be  fine  enough  such 
that  initial  alignment  can  be  accomplished  within  the 
desired  period  of  time. 

d'  Asynchronous  pulse-torquing  is  essential  to  eliminate  any 
shutdown  unrepeatabiiity  which  may  occur  as  a function 
of  the  rotor  synch  position.  If  the  pulsing  is  syn- 
chronous with  the  wheel  speed,  the  torquing  pulses  act 

lCtion  “m®P°rtions  of  the  rotor  for  each  rotor  revo- 
l ution . if  the  gyro  is  shut  down  and  restarted,  the 

rotor  may  synch  in  a new  position  relative  to  the  pulse 
modulation  frequency,  and  the  torquing  pulses  would  then 

e?Ve?rnthe  P°rtionf.°f  th*  rotor;  to  negate  this 

feet,  the  pulsing  is  applied  asynchronously  relative 
to  the  rotor  speed. 

Gyro  Capture-Loop  Design 

Ip^«iCneqUuitnaSthf0r  the  G'6  straP‘Joun  9yr°  are  presented  in 
stSdViVV  ? ?9  hfSe  equatlons  the  general  technique  for 

studying  the  capture-loops  was  developed  and  the  above  ground 
rules  were  then  incorporated  as  constraints.  9 

made^o?1^3  ^ App®nbix  D do  not  assume  the  simplifications 
made  for  the  gyro  model  in  reference  [3].  Those  simnlifvina 

?w?r2XVhatl0nS  Which  were  made  (1)  show  nutation  occurring  at 
twice  the  spin  speed  which  is  misleading,  (2)  will  indicate  that 

USt?ten-1?°P  resonance  wil1  occur  for  rate  inputs  at  this  assumed 
nutation  frequency,  which  again  is  misleading?  and  (3)  do  no? 

the°ef fects  of  the  gyro  lo  facilitate  "Vdying 

tne  errects  of  parameter  variations.  * y 
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The  equations  in  Appendix  D allow  for  the  real  values  of  moment 
of  inertia  and  for  the  effective  angular  momentums  H and  Hc  which 
result  from  the  rigorous  derivation  of  the  equations  of  motion  for 
dry  tuned  gyros  as  developed  in  reference  [31].  The  equations  also 
reduce  to  the  standard  equations  applicable  to  TDF  floated  gyros, 
in  which  case  H = Hc(Fm-  »),t  -*■  °°,  D equals  the  flotation  fluid 
damping,  and  equals  the  pigtail  spring  rate. 

To  capture  the  rotor,  torques  Max  and  May  are  applied  as  a func- 
tion of  the  pickoff  signals  6X  and  0y.  Generally  torque  can  be 
applied  about  either  axis  (or  both)  from  each  pickoff.  Therefore 
torque  about  X and  Y are  functions  of  0X  and  0y.  The  matrix  in 
equation  (3)  in  Appendix  D can  be  modified  to  include  the  torquing 
function.  To  examine  the  capture  loop  behavior,  the  off-tuning 
condition,  damping  and  time-constant  effect  can  be  neglected, 
i.e.,  let  = 0 and  AN  = 0.  Then  from  (3)  in  Appendix  D, 


— 

— 

— 

AS2  + Fd(S) 

HCS  + FC(S) 

0X(S) 

input 

driving 

1 

2 ' , v 

eY<s) 

functions 

-[HCS  + Fc  (S)  ] 

ASZ  + Fd(S) 

_ 

where 

Fd(S)  is  the  "direct-axis"  gain  and  compensation  and 
FC(S)  is  the  "cross-axis"  gain  and  compensation 

Definitions  of  other  terms  are  given  in  table  6-1. 

The  characteristic  equation  determined  from  the  determinant  of 
the  matrix  on  the  left  hand  side  of  (1)  is  useful  in  assessing  the 
stability  and  behavior  of  the  closed-loop.  There  are  a number  of 
ways  of  analyzing  this  equation.  Assuming  that  the ^ gain  and  com- 
pensation are  the  same  (symmetric)  for  both  axes  (F^  = FD  and 
= Fc) , the  characteristic  equation  is: 

AS2  + Fd(S)1  2 + [hcS  + Fc(S)j  2 = 0 

Note  that  this  expression  is  in  the  form  of: 

P2(S)  + Q2(S)  = [P ( S ) - jQ ( S ) ] [ P ( S)  + jQ (S) ] = 0 (2) 
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TABLE  6-1 . GYRO  NOMENCLATURE 


A 

C 

D 

F, 


D 

DC 


m 


S'GC 

H 


HC 

j 

K 

K 

KI 

Kp 


D 


M M 
aX,  aY 


M 


aXY 


MeX'MeY 

N 

S 

0X'eY 


XY 

x 

TT 


XY 


Rotor  transverse  moment  of  inertia 

Rotor  polar  moment  of  inertia 

Rotor  damping  relative  to  case 

"Cross-axis”  capture  loop  compensation 

"Direct-axis"  capture  loop  compensation 

Composite  complex  compensation,  F = F - ip 

DC  D J C 

Figure  of  merit 

Amplitude  of  pickoff  error  response 

Angular  momentum  associated  with  rotor  and  case 

rates  relative  to  inertial  space  ( e = e =0) 

X Y 

Angular  momentum  associated  with  rotor  rates 

relative  to  the  gyro  case  ($  = <j>  = 0) 

^ X Y 

Complex  notation  for  y/-l 
Capture-loop  gain  factor 
Gyro  in-phase  spring  rate 
Pickoff  scale  factor 
Torquer  scale  factor 

Torques  applied  to  rotor  (from  torquer) 

Vector  form  of  applied  rotor  torque. 


M = M + 
aXY  aX 


jM 


aY 


U) 


Disturbance  or  error  torques 
Rotor  spin  speed 
Laplace  variable 

Angular  displacements  of  the  rotor  relative  to 
the  case  (pickoff  angles) 

Vector  form  of  gyro  pickoff  signal,  0 = 0 + je 

Phase  of  pickoff  error  response 

Gyro  dynamic  time  constant 

Torquer  electrical  time  constant 

Angular  displacements  of  the  case  relative  to 
inertial  space 

Vector  form  of  case  input,  4>  = 4>v  + j 

Radian  frequency 
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and  the  roots  of  such  an  equation  can  be  found  from  either  factor 
of  equation  (2) . Any  complex  root  in  one  factor  will  have  its 
complex  conjugate  in  the  other  factor.  With  P(S)  = AS^  + FD(S) 
and  Q(S)  = H_S  + F_(S) , and  by  arbitrary  choice  of  a factor  in 

(2)  . 


P(S)  - j Q < S ) 


AS' 


fd(s) 


' - i [H( 


.s  + 


FC(S) 


(3) 


To  find  the  roots  of  this  factor  as  a function  of  the  gains  (by 
root-locus  techniques,  for  example)  the  form  is: 


Fp(S)  - jFc(S) 
AS2  - jHcS 


= -1  = 1/180* 


(4) 


A new  variable  FDC(S)  can  be  defined  which  represents  a complex 
gain  element. 


fdc<s)  ‘ fd(s)  - 1Fc(s) 

substituting  (5)  into  (4) 


(5) 


fdc(s) 


AS  ( S - jHc/A) 


= 1/180' 


(6) 


By  trying  various  compensations,  Fjjq(S)  , a suitable  closed  loop 
response  can  be  developed . Fj}(S)  can  then  be  determined  from 
the  real  parts  of  FDC(S),  and  FC(S)  from  the  imaginary  parts  of 


Another  powerful  mathematical  technique*  for  examining  stability 
from  the  set  of  equations  represented  by  (1)  generates  a transfer 
function  in  complex  form  (vector  form)  for  which  the  real  parts 
of  the  transfer  function  characterize  the  behavior  of  the  rotor 
about  the  X-axis,  and  the  imaginary  portion  characterizes  the 
behavior  about  the  Y-axis.  By  adding  the  first  equation  in  (1) 
to  j times  the  second  equation  gives 


AS  + FD(S) 


*See  Ref.  [34] 


0X(S)  + je  Y (S ) 


MH< 


s + f„(s)  ev(s)  - je v (s> 


= (summation  of  driving  terms) 


(7: 
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By  defining  a new  variable  (in  vector  form)  as  follows: 


0XY(s)  = f0x(s)  + jey(s)] 

and  substituting  into  the  left  hand  side  of  (7)  yields: 


AS  + Fd(S) 


0XY(S) 


- 3 [hcs  + rc<s)]  eXY(S) 


or. 


I L 


AS 


Vs) 


" 3 


Hcs 


FC(S) 


9xy (S) 


Note  that  the  term  in  brackets  is  the  same  as  in  (3)  and  indeed 
represents  the  characteristic  determinant.  This  can  then  be  out 
m the  same  form  as  (5)  and  (6). 


The  importance  of  this  analysis  is  that  the  input-output  relation- 
ships  can  now  be  determined  by  solving  for  0XY(S)  for  any  input 
condition  desired  and  noting  that  6X(S)  and  6Y(S)  can  be  obtained 

S!Pnra^Y  (resolved)  into  the  real  parts  and  the  imaginary  parts 
of  t)XY(S).  The  resolved  outputs  can  also  be  determined  from: 


0 


X 


and  0y 


9XY  ~ 9XY 

2 j 


where  0^y  (0^  j0y) , the  complex  conjugate  of  0 

x y 

Input  driving  functions  for  (7)  will  also  be  in  the  form  of 

MeXY<s>  or  <J>Xy(S),  where  any  symbol  in  the  form  of  fv„  is  defined 
as : XY 


fXY  = fX  + jfY  and  fXY  = fX  “ ^fY  (8) 

Note  also  that  the  feedback  torques  MaX  and  M v are  (in  vector 
form),  dropping  the  Laplace  operator  S,  aY 


MaXV  - Max  + 3»aY  - -Fdc  8xy 


( — jF^,)  ( 0X  + jQy) 
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and  that : 


_MaX  = Fd  6X  + FC  0Y  (Real  Parts) 

_M  = f 0 , - F_  ev  (Imaginary  parts) 
aY  D Y C X 


(9) 


or  in  matrix  form: 


MaX^ 

1 

o 

FJ 

r 1 

n 

fd 

.V 

The  siqn  of  the  feedback  was  chosen  with  some  forethought  with 
regard^to  stability,  and  this  resulted  in  the  form  fdc(S)  instead 
r>f  Fr^(S)  The  siqns  of  the  feedback,  of  course,  could  be 
arbitrary*  but  the  stability  of  the  closed  loop  would  reflect  the 
choice  as  a positive  or  negative  feedback.  The  stability  analysi 
would  reveal  the  desired  choice,  however. 

A block  diagram  of  the  captured  gyro  is  shown  in  figure  6-4. 

This  block  diagram  represents  equations  (1)  and  (2)  from  Appen 
dix  D,  with  equation  (9)  above  substituted  for  Max  and  May. 

Usinq  this  block  diagram  the  optimum  compensation  can  be  deter- 
miied.  clrtain  characteristics  of  the  compensation  are  essential 
if  the  basic  ground  rules  are  to  be  met,  for  instance,  it  is 
desirable  to  include  integral  gain  in  the  capture  loop  (type  I 
servo)  to  insure  a negligible  hang-off  error  for  constant  input 
rates.  A notch  at  the  gyro  spin  speed  is  also  desirable.  The 
•’noise"  signal  which  may  be  generated  at  spin  speed  is  charac- 
teristic to  all  tuned  rotor  gyros  and  is  nominally  minimized  by 
mechanical  adjustments  on  the  gyro  rotor.  However,  to  allow  for 
greater  freedom  in  the  mechanical  adjustment  a notch  is  provided 
to  reject  this  signal. 

With  these  factors  in  mind  the  characteristic  equation  for  the 
dynamic  behavior  can  be  developed.  From  equation  ( ) . 


fdc(s) 


AS  (S  - jHc/A) 


= 1 /180 ' 


(6) 
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where : 

^DC<S)  * FD(S)  'jFC<S) 

H /A  is  the  nutation  frequency  w 
c 11 

F (S)  is  the  gain  and  compensation  for  direct-axis 
D torquing,  i.e.,  X pickoff  driving  the  X-torquer, 
and  Y-pickoff  driving  the  Y-torquer 

F (S)  is  the  gain  and  compensation  for  cross-axis 
torquing 

From  basic  principles  of  gyrodynamics , torques  which  act  on  the 
rotor  at  low  frequencies  cause  gyroscopic  precession  on  an  axis 
at  riqht  angles  to  the  applied  torque  vector,  but  at  the  higher 
frequencies  (near  and  beyond  the  nutation  frequency)  the  gyro 
rotor  acts  more  1 ike  a pure  inertia  and  the  rotor  tends  to  dis 
place  about  the  same  axis  as  the  torque  vector.  This  character 
istic  suggests  using  a pure  gain  for  the  cross— axis  compensation 
Fc(S)  and  a lead  term  for  the  direct-axis  compensation  FD(S) . 

This  approach  is  indeed  optimum  for  capturing  the  gyro  rotor  to 
obtain  high  bandwidth,  but  generally  uses  more  components  to 
mechanize  than  the  normal  capture  loops  which  Litton  uses  for 
rebalance.  The  standard  capture  loop  is  mechanized  with  only  the 
"gyroscopic"  cross- torquing  function  F^(S)  and  the  loop  essen- 
tially meets  all  the  requirements  desired.  If  extremely  high 
bandwidth  is  found  to  be  advantageous,  then  the  direct-axis 
torquing  function  Fq{S)  can  easily  be  included  but  caution  is 
advised  since  the  torquer  noise  will  be  high. 

After  examining  the  capture— loop  compensation  suggested  in  ref- 
erence [3]  which  incorporated  direct- axis  capture,  it  has  been 
concluded  that  the  network  was  synthesized  solely  for  its  control 
characteristics  without  any  concern  for  noise  considerations. 

A plot  of  the  frequency  response  in  reference  [3]  shows  gains 
which  are  more  than  two  orders  of  magnitude  higher  at  the  har- 
monics of  spin  speed  than  at  the  lower,  controlled  frequencies. 

The  generation  of  relatively  high  output  signals  at  these  fre- 
quencies probably  explains  why  the  test  data  in  reference  [3] 
shows  rotor  excursions  which  are  more  than  three  times  the  theor- 
etical value  (12  mrad/rad/sec  peak  values  instead  of  approximately 
4 mrad/rad/sec)  since  the  gain  was  probably  limited  to  values 
much  less  than  that  desired. 

This  shows  the  importance  of  rolling-off  lead  networks  at  as  low 
a frequency  as  possible  after  they  have  served  their  purpose,  or 
noise  will  become  a very  serious  problem. 
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Dual-axis  Capture-Loop  Compensation 

The  optimum  dual-axis  capture  loop  compensation  is  shown  below. 
The  gains  are  rolled-off  as  soon  as  possible  after  the  required 
lead  near  the  nutation  frequency  (for  the  direct-axis).  The 
gain  beyond  the  notch  is  only  slightly  higher  at  its  peak  than 
at  midband  (but  orders  of  magnitude  lower  beyond  the  notch  than 
the  gain  suggested  in  reference  [3]).  Let: 


(S) 


K (S2  + N2) (S  - 
(S  + 5N)  2 (S2  + 2£ 


jN) 

NS  + N2) 


(10) 


then 


FD(S) 


(S  + 5N) 


KS(S2  + N2) 

2 2 T~ 

(S  + 2£  NS  + IT) 


and 


FC(S)  _ KN  (S2  + N2) 

(S  + 5N) 2 ( S2  + 2£  NS  + N2) 

Note  that  the  direct-compensation  has  no  gain  at  DC  and  acts  as  a 
lead  term  at  higher  frequencies.  The  cross-compensation  is  effec- 
tlve  Dc  but  rolls  off  at  higher  frequencies.  The  electronic 
circuitry  for  realizing  this  compensation  is  shown  in  figure  6-5. 
The  frequency  responses  for  these  compensations  are  shown  in 
figure  6-6  with  £ = 0.3. 

Equation  (10)  is  substituted  into  equation  (6)  and  a root-locus 

plot  is  drawn.  The  optimum  closed-loop  gain  is  selected  and  the 
gain  factor  K is  determined. 

Closed  Loop  Frequency  Response 

Using  the  gain  and  compensation  determined  by  the  root-locus  the 
closed-loop  frequency  responses  can  be  evaluated  for  the  pickoff 
error  signals  0^  and  0y  and  the  rebalance  torque  M,x  and  M.„  as 
a function  of  input  angular  rates  <£x  and  <pv.  a computer  program 
was  developed  which  solves  the  block  diagram  shown  in  figure  6-4. 
The  values  of  Fj)(S)  and  Fg(S)  above  were  used;  in  addition  inte- 
gral gain  was  included,  with  lead  recovery  at  60  rad/sec.  Plots 
of  these  responses  are  shown  in  figures  6-7  and  6-8. 


254 


403314 


Figure  6-5.  Electronics  for  Strapdown  Compensation 


Figure  6-7. 


Closed-Loop  Pickoff  Excursion  vs  Frequency 
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Single-Axis  Capture-Loop  Compensation 

The  recommended  method  of  capture  is  to  implement  only  the  cross- 
axis compensation  FC(S).  The  reasons  for  this  conclusion  have 
been  previously  stated.  Since  a notch  is  used  at  the  spin-speed, 
the  bandwidth  of  the  gyro  is  certainly  limited  to  less  than  spin- 
speed  using  either  capture  loop  approach.  The  bandwidth  obtained 
in  either  case  is  also  more  than  adequate  for  the  system. 

The  following  compensation  is  found  to  be  optimum  for  single -axis 
capture : 


FC(S)  - 


K [ (S/N)  + 1)  (S  + 

rpqr  — 


55) 


(S/2N)  + 1 J (S/N)Z  + (2£  S/N)  + 1 


)'  ° 


F_  (S)  = 0 


This  compensation  is  characterized  by  a twin-T  notch  at  spin  speed 
N,  three  lags  at  twice  the  spin  speed,  a low-Q  bandpass  at  spin 
speed  (f;  = 0.03),  and  integral  gain  with  lead  recovery  at  about 
9 Hz.  The  frequency  response  for  the  compensation  itself  is 
shown  in  figure  6-9.  It  can  be  seen  that  there  is  a high  rejec- 
tion of  signals  beyond  the  bandwidth  since  this  compensation  con- 
sists primarily  of  lag  networks.  It  is  important  that  the  phase 
of  the  torque  at  nutation  be  more  than  90°  lagging  behind  the 
pickoff  to  guarantee  damping  at  this  frequency.  Tests  using  this 
circuit  show  extremely  low  noise  for  such  a high  bandwidth. 

Frequency  response  plots  for  the  pickoff  error  signal  and  rebal- 
ance torque  are  shown  in  figures  6-10  to  6-13. 


6.2.2  Gyro  Rebalance  Loop  Electronics 

The  basic  design  approach  to  rebalance  the  inertial  strapdown 
sensors  is  through  pulse  duration  modulation,  a well  known  tech- 
nique which  provides  direct  digital  output  while  still  maintaining 
superior  linearity  and  environmental  capability.  The  basic  block 
diagram  of  a loop  is  shown  in  figure  6-14.  Functionally,  vehicle 
angular  motion  produces  a signal  out  of  the  gyro  pickoff.  This 
signal  is  amplified,  demodulated,  filtered  and  then  compared  with 
a sawtooth  signal  to  produce  a time  modulated  rebalance  current 
through  the  gyro  torquer  to  balance  the  input  motion.  This  loop 
is  basically  a servo  system  which  nulls  the  pickoff.  The  gyro 
torquer  is  electrically  part  of  an  "H”  bridge  arrangement.  A 
constant  current  source , which  is  driven  from  a precision  voltage 
reference , is  switched  by  control  signals  from  the  voltage  to 
pulse  converter.  Figure  6-15  shows  a representation  of  the  bridge 
arrangement . A higher  voltage  is  switched  into  the  bridge  during 
large  angular  rates  of  the  vehicle. 
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Figure  6-10.  Strapdown  Gyro  Loop  Pickoff  Response  (Direct) 
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Figure  6-11.  Strapdown  Gyro  Loop  Pickoff  Response  (Cross  Axis) 
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Figure  6-13.  Strapdown  Gyro  Loop  Frequency  Response  (Cross  Measurement) 
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Figure  6-14.  Typical  Pulse-Rebalance  Loop 


403314 


Figure  6—15.  Rebalance  Electronics  Bridge  Arrangement 
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The  operation  of  the  loop  can  be  understood  with  the  aid  of  fig- 
ure 6-16.  Input  vehicle  motions  generate  an  error  signal  which 
is  summed  with  a sawtooth  waveform  of  a basic  2K  Hz  period  called 
the  limit  cycle  frequency.  At  the  start  of  each  limit  cycle,  the 
torquer  current  is  positive  until  the  error  signal  is  equal  to 
the  sawtooth.  The  torquer  current  is  then  switched  {by  switching 
the  torquer)  to  remain  in  the  opposite  direction  until  the  end  of 
the  limit  cycle.  At  time  T,  the  bridge  is  again  switched  to  a 
positive  direction  until  another  comparison  is  made  during  the 
second  limit  cycle.  The  net  result  is  a current  waveform  whose 
average  value  is  equivalent  to  that  required  to  null  the  pickoff . 
Average  current  is  therefore  synchronous  with  the  crossover  time. 

The  master  clock  data  pulses  are  synchronous  with  the  limit  cycle 
frequency.  Since  the  bridge  is  permitted  to  be  switched  only  at 
an  integral  number  of  clock  pulses,  the  number  of  clock  pulses 
between  the  start  of  the  limit  cycle  and  the  time  the  bridge  is 
switched  is  an  extremely  accurate  measurement  of  average  rebal- 
ance torque.  The  clock  pulses  (409.6  K Hz)  and  converter  control 
signal  are  then  fed  to  a counter  in  the  serial  data  section  to 
provide  the  equivalent  incremental  change  in  angle  (A0s)  in  digi- 
tal form  to  the  computer.  For  a 2.048  K Hz  limit  cycle  with  a 
409.6  K Hz  data  pulse  rate,  zero  pulses  per  limit  cycle  repre- 
sents full  negative  input  rate,  200  pulses  per  limit  cycle  repre- 
sents full  positive  input  rate. 

The  electrical  design  success  is  predicated  upon  having  an 
extremely  accurate  and  stable  rebalance  current.  Therefore  all 
circuits  associated  with  this  function  are  considered  critical. 

In  general,  all  circuits  employ  state-of-the-art  solid-state 
monolithic  integrated  circuits  to  the  extent  that  available  com- 
ponetns  are  capable  of  performing  the  required  task.  Where  per- 
formance requirements  are  beyond  the  capability  of  monolithic 
circuits,  hybrids  are  employed.  Discrete  components  are  used 
where  the  ultimate  in  performance  demands  their  use.  All  circuits 
are  designed  to  meet  the  most  stringent  applicable  specifications. 

The  input  (front-end)  section  of  each  pulse— rebalance  loop  employs 
presently  existing,  well-proven,  production  hybrid  circuits.  The 
H-switch  uses  FET  technology  to  minimize  current  imbalance  between 
the  two  switched  output  current  directions  and  to  minimize  leakage 
and  base-drive-current  contamination  at  the  torquer  coil.  This 
coil  is  RC  tuned  to  cause  the  winding  to  appear  as  a purely  resis- 
tive load  to  the  current  switch,  preventing  switching  transients 
from  appearing  at  the  current  source. 
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6.2.3  A- 1000  Accelerometer  and  Loop  Dynamics 


Description 


The  A-1000  accelerometer,  figure  6-17  is 
pendulous,  to rque-to-ba lance  instrument 
plicity,  small  size,  and  high  precision, 
demonstrated  capability  of  withstanding 
environments.  Key  design  features  are: 


a flexure-supported, 
characterized  by  sim- 
Its  design  has  a 
a wide  range  of  operationa 


1 


a.  Extremely  simple,  small,  and  lightweight. 

b.  Low  threshold,  providing  excellent  gyrocompass 
per  formance . 

c.  Single  me tal ization  pattern  forming  capacitive  pickoff 
plates,  circuitry,  and  flexure. 

d.  Minimal  thermal  lag. 

Excellent  rapid  reaction  and  extremely  low  temperature  sensitivity 
is  achieved  by  a combination  of  mechanical  design  and  electrical 
compensation . 


Principle  of  Operation 

The  sensitive  element  of  the  accelerometer  is  a disc  supported  by 
flexures  which  permit  rotation  about  a diameter.  The  disc  is 
made  pendulous  by  the  addition  of  a weight  which  displaces  the 
center  of  gravity  in  the  plane  of  the  disc  and  normal  to  the 
hinge  axis.  Accelerations  perpendicular  to  the  plane  of  the  di  c 
result  in  rotation  about  the  hinge  axis.  This  rotation  is  sensed 
by  the  capacitive  pickoff  which  produces  a phase-sensitive  signal 
proportional  to  the  angular  displacement.  .This  output  is  amp 
f ied  and  is  compared  with  a ramp  which  pulse-width-modulates  the 
error  signal  in  digital  increments.  This  signal  is  used  to  control 
the  timing  of  the  current  switches  which  produce  precise  amplitude 
current  pulses  whose  timing  is  related  to  the  loop  error  signal 
and  drive  the  accelerometer  torquer  coil.  The  current  in  the 
torquer  magnet  produces  a torque  equal  and  opposite  to  tne  accei 
eration  induced  torque. 


A-1000  Loop  Dynamics 

A block  diagram  representing  the  dynamics  of  the  A-1000  is  shown 
in  figure  6-18.  This  model  includes  (a)  the  back  EMF  generate 
by  the  torquer,  (b)  the  circuit  placed  in  parallel  with  the 
torquer  for  optimizing  the  pul se-torqued  wave-shape,  and  (c)  the 
resonance  and  anti-resonance  (node)  of  the  suspension. 

By  using  standard  servo  techniques  the  optimum  gain  and  phase  was 
determined.  A computer  was  programmed  to  determine  the  frequency 
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Figure  6-17 . A-1000  Accelerometer 


403314 


responses  for  this  configuration.  Figure  6-19,  shows  the  pickoff 
excursion  (proof  mass  rotation  relative  to  the  case)  for  applied 
accelerations.  ^ 

Figure  6-20  relates  the  frequency  response  for  acceleration 
inputs.  For  a pulse- torqued system  this  is  determined  by  noting 
the  output  VQ  (to  the  pulse-torquing  network)  for  acceleration 
inputs  Z0.  Definitions  of  the  various  terms  are  given  in 
table  6.2 . 

6-2.4  Accelerometer  Rebalance  Electronics 

The  accelerometer  rebalance  electronics  are  virtually  identical  to 
that  of  the  gyro.  Loop  gain  and  compensation  and  torquer  current 
levels  are  different,  however.  The  accelerometer  circuit  imple- 
n^^tation  is  simpler  since  a less  sophisticated  transfer  function 
is  needed,  and  dual-mode  current  level  is  not  required. 

Table  6-3  gives  pertinent  information  on  the  accelerometer  digital 
rebalance  loop. 

6.2.5  IMM/Computer  Interface 

The  IMM/Computer  interface  functions  as  a pulse  accumulator  for 
the  two  gyro  and  two  accelerometer  data  channels.  Parallel  pulse 
data  from  the  accelerometers  and  gyros  is  counted  at  a 409.6  KHz 
clock  rate.  Data  is  gathered  for  a period  of  7.8125  msec.  At 
the  completion  of  each  data  gathering  period  an  interrupt  is  gen- 
erated to  the  computer  which  functions  as  a real-time  clock 
(128  Hz)  and  cues  the  system  software  to  retrieve  the  accumulated 
pulse  data  from  this  channel  and  all  other  channels. 

Accumulation  of  pulse  data  is  performed  with  a "micro— processor " 
up-down  counter  as  illustrated  in  figure  6-21. 

Pulse  data  are  sampled  each  data  clock  time;  a data  level  of  "1" 
causes  the  counter  to  count  up  while  a data  level  of  "0"  causes 
it  to  count  down.  For  the  gyro  signals,  a Hi-Mode  discrete  is 
sampled  which  applies  a scale  factor  to  the  accumulated  pulses. 
Pulses  are  accumulated  for  one  data  gathering  period  and  the 
resultant  count  is  stored  for  computer  readout.  The  counters  are 
zeroed  at  the  start  of  each  data  gathering  period  and  the  process 
is  repeated. 

In  addition  to  the  four  accumulated  gyro  and  accelerometer  data 
channels,  a self-test  channel  will  be  implemented  to  help  detect 
any  faults.  This  channel  will  always  count  up  at  each  clock  time. 
This  function,  when  accessed  by  the  computer  at  the  end  of  a data 
gathering  period,  will  always  yield  the  same  value  when  the  system 
is  functioning  properly. 
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Figure  6-19.  Accelerometer  Loop  Pickoff  Response 
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i.gure  6-20.  Accelerometer  Loop  Frequency  Respo 
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TABLE 

6-2.  ACCELEROMETER  NOMENCLATURE 

B 

Damping  about  output  axis 

G 

Gain  of  servo  compensation 

Moments  of  inertia  of  sensitive  element  about 

OA'  IA'  PA 

OA,  IA  and  PA  respectively 

Kf 

Torquer  back-emf  coefficient 

KP 

Pickoff  scale  factor 

kt 

Torquer  scale  factor 

Ke 

L 

Torsional  spring  rate  of  suspension 

Torquer  inductance 

m,  n,  q,  C 

Coefficients  for  impedance  function  Zp  for 
tuning  circuit  across  torquer  coil 

OA,  IA,  PA 

Output  axis,  input  axis,  and  pendulous  axis 

P 

Pendulosity 

R 

Torquer  resistance 

Y 

Q 

Equivalent  DC  admittance  for  pulse- torquing 

£ 

Damping  factors  of  structural  frequencies 

Damping  factor  for 

*1 

Damping  factor  for 

U) 

Lead  recovery  frequency  for  integral  gain 

WA 

Demodulator  roll-off  frequency 

wb 

Complex-lag  natural  frequency 

Lead  frequency 

(JO 

rv 

Mechanical  node  frequency 

u 

W1 

Open-loop  pendulous  oscillation  frequency 

"t 

Structural  resonant  frequency 
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TABLE  6-3'.  SENSOR  LOOP  OPERATIONAL  PARAMETERS 


PARAMETER 

ACCELEROMETER 

Maximum  range 

12  g 's 

Usable  range 

11  g's 

Pulse  repetition  rate 

409.6  KHz 

Pulse  weight  (scale  factor) 

5.88  x 10  4 m/sec  (0.00193 
ft/ sec) /pulse 

Pulse  width 

2 . 5 psec 

Pulse  modulation  frequency 

4.096  KHz 

Sensor  stops 

±3  mr 

Torquer  current 

2 0 ma 

A RAM  within  the  microprocessor  is  used  as  a memory  device  This 
memory  is  partitioned  into  two  sectors,  a "count-memory"  and  a 
storage  memory.  During  a data-gathering  period,  one  sector 
accumulates  counts  from  the  accelerometers  and  gyros  while  the 
other  sector  stores  the  data  from  the  previous  data  gathering 
period.  After  completion  of  a data  gathering  period  the  two 
sectors  change  functions  and  the  first  sector  becomes  available 
for  computer  readout.  The  storage  memory  sector  is  zeroed  as  it 
transitions  to  a "count-memory"  sector.  Management  of  the  RAM 
memory  functions  is  done  within  the  control  logic  function  of 
the  microprocessor. 

In  addition,  the  IMM/ Computer  interface  will  be  capable  of  trans- 
ferring  factory  derived  instrument  constants  from  local  PROMs 
within  the  IMM  to  the  software.  Temperature  sensor  data  (from 
A/D  converters)  will  also  utilize  this  interface.  Data  paths 
for  all  these  variables  may  be  routed  through  the  same  "micro- 
processor”  up-down  counter. 
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Figure  6-21.  Functional  Block  Diagram  IMM/Coraputer  Interface 
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6-2.6  Computer  Description 

The  computer  for  the  redundant  strapdown  INS  will  be  assumed  to 
have  an  architecture  similar  to  the  Litton  4516  family  of  com- 
puters. In  production  since  the  early  '70 's,  this  family  of 
microprogrammable  Central  Processing  Units  has  been  used  exten- 
sively in  various  system  configurations,  notably  B-l  RFS/ECMs 
AGM-86A  (SCAD) , LN-33  (F-5E) , MPU  (CP-1149  for  DD-963)  TEREC ' 
(RF-4) , and  ECU  (DD-963) . 

t0  economically  satisfy  a wide  range  of  applications 

^urp4fh6i-arChlt^CtU^e  employs  a microprogrammable  control  struc- 
ture that  provides  design  flexibility  and  growth  to  an  extended 
instruction  set  through  the  reprogramming  of  PROMs  within  its 
control  structure.  The  4516  is  a 16-bit,  fully  parallel  general 
purpose  digital  computer.  Its  basic  instruction  length  is  16  bits 
ut  a ful1  complement  of  32  bit  instructions  is  also  included 
permitting  a powerful  selection  of  addressing  modes.  Arithmetic 
processing  includes  provisions  for  both  single  (16-bit)  and 

ouble  32-bit)  precision  arithmetic  as  well  as  a complete  set 
of  logical  operations.  p ser 

Maximum  size  of  storage  addressable  by  the  4516  family  is  65  536 
words  The  dominant  mode  of  addressing  is  relative  through  the 
use  of  base/index  registers.  However,  all  four  modes  of  address- 
ing are  provided;  direct,  indirect,  relative  and  immediate. 

^fl???n);tfQTPrOPOSef  f°r  ^ straPdown  INS  will  be  mechanized 

9 circuits,  solid  state  Random  Access  memories  (RAMS) 

aemf°^arD  sporafe  of  dynamic  system  variables,  non-volatile 
solid-state  Read-Only-Memories  (ROMs)  for  microprogram  control 

instruction  memories.  The  RAM  power  will  be  battery-supported 
for  storage  of  system  variables  that  need  to  be  retained  after 
power  has  been  turned  off. 

Various  hardware  implementation  approaches  utilizing  microprocessor 
LSI  circuits  from  the  semiconductor  industry  are  applicable. 

ompanies  active  in  this  field  include  Fairchild,  Intel,  Advanced 
Micro  Devices,  Texas  Instruments,  American  Microsystems,  Inc., 
and  National  Semiconductor.  All  of  the  currently  available  micro- 
processor  designs,  with  the  exception  of  the  AMD  AM2901  which 
utiiizes  a low-power  Schottky  TTL  process  are  somewhat  marginal 
for  the  strapdown  problem. 
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COMPUTER  PROCESSING  UNIT  (CPU) 

Tho  following  description  is  an  example  of  the  type  of  micro- 
processors that  are  currently  available  in  the  semiconductor 
marketplace.  AMD's  AM2900  microprocessor  system  consists  of  a 
family  of  bipolar  LSI  building  blocks  that  can  be  configured  in 
numerous  system  configurations.  Figure  6-22  is  a functional 
block  diagram  of  a typical  central  processor  unit  (CPU)  using 
microprogrammed  high-speed  bipolar  microprocessor  circuits. 

The  heart  of  the  system  is  the  AM2901  bipolar  microprocessor 
(figure  6-23)  . This  four-bit  element  consists  of  a 16-word  by 
four-bit  two-port  random  access  memory,  a high  speed  arithmetic 
and  logic  unit  and  associated  shifting,  decoding  and  multiplexing 
circuitry.  Four  such  chips  are  used  to  form  the  data  path  portion 
of  the  CPU.  All  machine  level  data  operations  (i.e.,  add,  sub- 
tract, multiply,  divide,  etc.)  are  performed  utilizing  these 
chips . 

Control  of  the  CPU  is  performed  primarily  with  the  microprogrammed 
PROM  memory  and  the  microcode  sequencer  which  is  used  to  control 
the  microstep  operations  within  each  instruction  cycle.  The 
microprogrammed  memory  contains  256  28— bit  words  and  is  provided 
by  seven  256  x 4 bit  PROMS.  (For  production  machines,  it  may  be 
more  cost  effective  to  replace  this  part  with  a comparable  ROM.) 

The  A/B  address  registers  control  the  data  sources  of  the  Random 
Access  Memory  (RAM)  within  the  microprocessor.  This  RAM  con- 
tains the  program  counters  (old  and  new  values) , the  base  register, 
the  general  registers  (9) , the  accumulators,  and  the  stack  and 
Z registers  as  required  by  the  4516  architecture.  Data  in  any 
of  the  16  words  of  the  RAM  can  be  read  from  the  A-port  of  the 
RAM  as  controlled  by  the  4— bit,  A-address  field.  Likewise,  data 
in  any  of  the  16  words  of  the  RAM  as  defined  by  the  four-bit 
B-address  field  can  be  simultaneously  read  from  the  B-port  of  the 
RAM.  (See  figure  6-23.) 

When  enabled  by  the  RAM  write  enable  signal,  new  data  is  written 
into  the  16-bit  word  defined  by  the  B-address  field.  The  RAM 
data  input  field  is  driven  by  a three-input  multiplexer  which 
allows  shifting  of  the  ALU  output  if  desired. 

The  ALU  can  perform  any  of  three  binary  arithmetic  or  five  logical 
operations  on  the  two  inputs  (R»  S)  of  the  ALU.  The  R— field  is 
driven  from  a two— input  multiplexer,  while  the  S field  is  driven 
from  a three-input  multiplexer.  Both  multiplexers  have  an  inhibit 
capability  in  which  no  data  is  passed.  This  multiplexer  scheme 
gives  the  capability  of  selecting  a large  number  of  source 
operand  pairs  together  with  the  eight  possible  operations  to  yield 
a very  powerful  microprocessor . The  output  of  the  ALU  is  con- 
trolled by  microcode  bits  which  route  the  ALU  function  to  either 
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Figure  6-22.  Functional  Block  Diagram  of  CPU  Using  AMD  Chips 
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the  output  register,  the  Q register,  or  the  RAM.  In  combination 
with  the  input  multiplexers  of  the  RAM  and  Q register,  this 
microcode  enables  the  processor  to  perform  the  necessary  micro- 
steps  of  more  complicated  functions  such  as  multiply  and  divide. 

AMD  also  provides  a look-ahead  carry  generator  (AM2902)  chip 
which  provides  the  capability  of  multi-level  look-ahead  operation 
for  high  speed  arithmetic  operation  over  large  word  lengths  (i.e. 
larger  than  four-bits) . This  chip  has  a typical  propagation 
delay  of  approximately  six  nsec. 

The  AM2918  Quad  D-type  flip-flop  register  provides  additional 
flexibility  in  system  configurations.  It  is  used  in  typical 
designs  as  the  address  register,  the  instruction  register,  the 
status  register,  and  the  data  output  register.  Both  three-state 
and  standard  totem-pole  outputs  are  provided  for  interfacing  with 
data  buses  or  for  internal  registers. 

Thus  the  entire  central  processing  unit  for  a complex  16-bit 
machine  can  be  implemented  using  this  family  of  LSI  components 
in  conjunction  with  some  standard  SSI  circuitry  for  clock  and 
control . 

A summary  of  the  4516  General  Characteristics  is  given  in 
table  6-4. 

The  LC— 4516  instruction  set  consists  of  49  instructions.  These 
are  grouped  into  nine  load  and  store,  9 logic  and  arithmetic, 

8 transfer,  and  23  register-to-register , I/O,  and  control.  The 
main  features  of  each  of  these  four  groups  are  as  follows: 

Load  and  Store  (9  total) 

• 16,  32-bit  lengths 
Logic  and  Arithmetic  (9  total) 

• 16  and  32-bit  fixed-point  add/subtract 

• 16  and  32  bit  fixed  point  multiply 

• Overflow  and  fault  detection 

• High-speed  multiply  and  divide 

• Double-add-of-carry  for  64-bit  summing 
Transfer  (8  total) 

• Minus,  zero,  register  test  conditionals 

• Automatic  PC  save  and  return 

• Incremen t-test-transf ers 
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TABLE  6-4.  4516  GENERAL  CHARACTERISTICS 


Word  Lengths 

16  or  32  bits  (data  word) 
16  bits  (instruction  word) 

Instruction  Type 

Single-address,  single  instruction, 
indexable 

Computation  Process 

Parallel 

Data  Format 

Fixed-point,  fractional 
binary  2's  complement 

Input-Output 

Programmable  I/O 
Direct  Memory  Access 
External  Interrupt  System 

Addressing  Range 

65,536  words 

Addressing  Modes 

Direct  Address 

Relative  Addressing 

Indirect 

Base  Addressing 

Indexing 

Literal 

Register-Register 

Number  of  Instructions 

49 

Regis ter- to-Regis ter , Shift,  and  I/O  (23  total) 

• Compare  register-to-register 

• Copy/exchange  register-to-register 

• Add/Sub  register-to-register 

• S ingle/double— length  shifts 

• Complements 

• Input/output  to/from  accumulator 

• Double-length  normalization 

• Interrupt  mask  control 

• Hardware/software  reset/restart 
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Utilizing  microprocessing  chips  with  the  assumed  speed 
characteristics,  the  instruction  speeds  of  table  6-5  are 
achievable. 


TABLE  6-5.  TYPICAL  INSTRUCTION  TIMES 


Microprocessor  Cycle  Time 

100 

nsec 

Memory  Cycle  Time 

600 

nsec 

Memory  Access  Time 

200 

nsec 

Load/Store 

1.4 

usee 

Add/Subtract/Logical  (16  bits) 

1.4 

usee 

Double  Precision  Add/Sub  (32  bits) 

2.2 

usee 

Multiply 

3.2 

usee 

Double  Precision  Multiply 

11.0 

usee 

Divide 

3.4 

usee 

Transfers 

1.0 

usee 

MEMORY  SYSTEM 


The  memory  requirements  for  the  system  are  as  follows: 

MEMORY  TYPE  NO.  WORDS  (16-bit) 

Random  Access  Memory  (RAM)  1024 

Read  Only  Memory  (ROM)  8192 

In  addition,  there  is  a microprogram  control  store  memory  require- 
ment which  is  considered  a part  of  the  Control  Processing  Unit. 

Random  Access  Memory  (RAM) 

The  RAM  memory  chosen  for  this  application  is  a high-speed 
CMOS-SOS  static  storage  device  which  is  organized  as  1024 
words  x 4-bit  with  an  access  time  of  200  nsec  and  a cycle  time 
of  300  nsec.  The  chip  uses  DC  stable  (static)  circuitry  and 
requires  no  clocks  or  refreshing  to  operate.  Data  are  read  out 
nondestructively  and  are  compatible  with  TTL  circuits  in  all 
respects.  While  devices  of  this  storage  capacity  are  not  yet 
available,  it  is  assumed  that  they  will  be  so  by  the  time  the 
redundant  strapdown  INS  begins  its  final  design  phase. 
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Each  RAM  memory  interfaces  with  the  other  three  computers  in  the 
system  via  memory  ports  as  shown  in  figure  6— 2.  Also,  the 
microprocessor  is  tentatively  organized  as  a 3 bus  system:  an 

address  bus,  a data  input  bus  and  a data  output  bus.  These 
internal  busses  communicate  with  all  the  functional  elements 
(i.e.  the  ROMs,  the  IMM  interface,  and  the  external  memory  con- 
troller, etc.)  of  the  individual  channel.  The  port  method  of 
intercomputer  interfacing  provides  read-only  capability  for  the 
other  channels  in  the  redundant  system.  Priority  control  logic 
in  the  memory  unit  assures  that  multiple  requests  can  be  effec- 
tively serviced  and  that  a failed  channel  cannot  swamp  out  or 
nullify  any  other  channel.  A battery  is  also  provided,  normally 
in  a charge  mode,  for  data  non— volatility . 

Read-Only  Memory  (ROM) 

The  ROM  for  each  channel  is  mechanized  with  LSI  chips  contained 
in  24  pin  dual-in-line  packages  that  have  16K  memory  elements/ 
chip  organized  in  a 2048  words  x 8 bits/word  configuration.  The 
ROM  memory  requires  only  eight  mask-programmable  LSI  chips. 
Instructions  and  constants  are  permanently  stored  in  the  devices 
by  use  of  a special  metallization  pattern  supplied  to  the  vendor. 

The  ROM  memory  elements  feature  advanced  Schottky  processing, 
low  power  dissipation  (0.5w)  and  fast  access  time  (200  nsec) . 
Cycle  time  is  600  nsec.  The  LSI  chips  are  organized  in  a 4 x 2 
matrix  to  form  an  8192  word  x 16— bit  memory.  The  output  is  tri- 
state  and  similar  outputs  of  each  column  are  connected  together. 
All  devices  except  the  pair  selected  are  placed  in  the  high 
impedance  state  thus  giving  the  output  the  characteristics  of  a 
TTL  totem  pole  output. 

6.2.7  Input/Output  System  Description 

Communication  with  the  external  aircraft  system  will  be  repli- 
cated in  all  four  channels.  It  has  been  designated  to  be  all- 
digital,  serial  and  in  the  format  defined  in  ARINC  575.  It  is 
assumed  that  the  output  transmission  system  of  each  channel  will 
be  directed  at  another  avionics  subsystem  that  can  accept  the 
four  outputs  and  perform  its  own  voting  and  fault— masking 
routines.  In  addition,  each  channel  will  accept  inputs  from 
three  separate  transmission  systems.  This  is  consistent  with  the 
concept  that  failure  in  any  element  of  one  channel  will  cause  the 
failure  of  that  channel  but  not  the  failure  of  another  channel. 

The  ARINC  575  digital  message  format  consists  of  a serial  trans- 
mission scheme  in  which  data,  word  synchronization  and  clock  are 
transmitted  over  a single  pair  of  wires  at  a frequency  of 

11  + 2.0  kHz.  Each  word  consists  of  32  bits  with  a minimum  of 
3 . 5 
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four  bit  lengths  (91  +42/-14  usee)  of  blanks  (zero  voltage) 
between  words.  The  data  word  can  be  either  in  a binary  coded 
decimal  (BCD)  data  format  or  a fractional  two's  complement  binary 
(BNR)  format.  In  either  case  the  eight  Least  Significant  Bits 
(LSB's)  of  the  word  contain  address/label  information  while  the 
rest  of  the  word  (24  bits)  contains  the  data  and  a two-bit  coded 
designation  matrix  indicating  sign  and  validity  information.  In 
the  case  of  binary  data,  the  Most  Significant  Bit  (MSB)  is  used 
parity  checking.  Details  of  the  transmission  scheme  are 
found  in  ARINC  575. 

Three  receivers  will  be  provided  in  each  channel.  One  receiver 
will  provide  altitude  information,  and  the  second  receiver  will 
provide  initial  position  and  mode  information  from  an  avionics 
display  unit.  This  input  will  be  used  only  at  system  start  up  or 
^■^f requen tly  in  flight  for  mode  changes.  The  third  receiver  is 
provided  for  interfacing  with  another  avionics  subsystem  in 
order  to  provide  position  and  velocity  up-date  information. 

6-2.8  Power  Supply  and  Support  Electronics 

The  remainder  of  electronics  needed  to  complete  a redundant 
strapdown  INS  is  shown  in  block  diagram  form  in  figure  6-24. 
Primary  aircraft  power  is  converted  to  DC  which  is  used  to  derive 
the  various  voltages  needed  by  the  electronic  components.  It  is 
also  used  to  charge  the  battery  which  provides  the  backup  power 
in  the  event  of  aircraft  power  interruptions. 

Mode  seguencing  circuits  are  used  to  initiate  gyro  spin  power 
when  power  supply  voltages  are  stabilized  and  close  gyro  and 
accelerometer  digital  rebalance  loops  when  gyro  motors  are  up  to 
speed. 

Self-test  circuits  monitor  critical  gyro,  accelerometer,  and 
power  supply  signals.  When  a failure  is  detected,  the  computer 
is  sent  an  interrupt  so  it  can  perform  its  shutdown  subroutine, 
and  a failure  indication  is  provided  to  other  aircraft  avionics. 

A variety  of  frequency  references  are  provided  by  the  crystal 
oscillator  and  countdown  circuitry  for  such  things  as  instrument 
pickoff  excitation,  gyro  spin  power,  digital  rebalance  loop  con- 
trol, I/O  circuit  counting  and  timing,  computer  clock,  the  soft- 
ware executive  interrupt,  and  a computer-read  time  word  used  in 
the  solution  of  the  equations  to  compensate  for  computational 
time  delays.  A watch-dog  timer  is  also  incorporated,  reset 
periodically  by  software.  If  a problem  develops  and  software 
cannot  reset  the  timer,  self-test  circuits  are  activated  to 
indicate  a computer  failure.  This  timer  is  run  off  a separate 
oscillator  to  be  able  to  detect  main  crystal  oscillator  failures. 
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The  software  executive  interrupt  pulses  between  the  four  com- 
puters are  synchronized  with  the  included  logic  circuitry. 

Since  a minimum  IMM/computer  I/O  implementation  is  achieved  with 
computer  interrupts  derived  by  count-down  from  gyro/accelerometer 
marker  pulses,  synchronization  at  this  level  is  also  desirable. 
Circuit  design  of  this  element  is  also  subject  to  the  fail-op/ 
fail-op  requirement.  Failure  modes  which  cause  loss  of  interrupt 
pulses  or  non-synchronization  of  more  than  one  channel  must  be 
avoided . 

6.2.9  Self-Test 

The  self-test  requirements  for  the  redundant  strapdown  INS  are 
reduced  from  those  of  a single-string  system.  Voting  methods 
provide  very  effective,  high-coverage  failure  detection  and 
isolation  for  both  fail-op  levels. 

Self-test  goals  are: 

• To  prevent  chain-type  failure  modes  which  could  lead 
to  extensive  equipment  or  aircraft  damage. 

• To  provide  a high  level  of  capability  of  detecting 
failures  of  each  gyro  to  reduce  the  probability  of  a 
failure  occurring  within  the  3— gyro  isolation 
singularities. 

• To  contribute  to  making  the  third  failure  a fail-safe 
condition,  that  is,  to  indicate  to  the  aircraft  flight 
crew  that  a failure  has  occurred. 

• To  provide  information  to  maintenance  personnel  for  use 
in  determining  the  failed  module  for  repair. 

Because  of  the  high  effectiveness  of  redundancy  management,  a 
minimum  amount  of  circuitry  should  be  used  for  self-test,  except 
that  needed  to  protect  the  equipment  against  self-destruction. 
The  main  self-test  features  providing  this  protection  are  in  the 
power  supply.  Over-voltage,  under-voltage,  and  over-current 
detectors  sense  potentially  destructive  conditions  and  shut  down 
channel  power.  An  interrupt  is  sent  to  the  computer  which  then 
executes  a shut-down  subroutine,  as  shown  in  the  system  block 
diagram  of  figure  6-2. 

Gyro  self-tests  consist  of  loop  closure  monitors  which  detect 
uncontrolled  pickoff  excursions,  a high  rate  mode  timer  which 
indicates  a failure  if  a gyro  axis  is  in  the  high  rate  mode  for 
an  unreasonable  length  of  time,  and  a wheel  pickoff  monitor  which 
detects  differences  between  actual  and  synchronous  spin  speed. 
Accelerometer  self— test  consists  of  a pickoff  monitor  to  detect 
loop  closure  problems.  Temperature  sensors  amplifiers  detect 
open  and  short  circuit  conditions. 
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The  digital  subsystem  has  a variety  of  simple  test  provisions. 
IMM/computer  I/O  has  a separate  self- test  input  channel,  other 
digital  I/O  has  simple  wrap-around  provisions  and  parity  tests 
as  applicable,  the  computer  cycle  is  checked  with  the  watch-dog 
timer,  the  instrument  PROM  would  have  test  words  and  parity  bits. 
The  A/D  converter  has  a separate,  constant  DC  reference  channel. 

A computer  software  subroutine  provides  assistance  to  hardware 
provisions  by  means  of  wrap-around  comparisons,  comparison  of 
reference  or  test  inputs  to  expected  values,  and  reasonable- 
ness tests  on  temperature  and  other  measurement  data.  Software 
memory  and  op— code  tests  are  also  performed. 

Mode/BITE  logic  assembles  hardware  self-test  results  into  a word 
available  for  input  into  the  computer  during  a power  supply  shut- 
down interrupt.  Software  self-test  and  redundancy  management 
results  are  also  available  in  non-volatile  memory  for  subsequent 
review  by  maintenance  personnel  during  repair.  Failure  of  either 
type  actuates  a failure  indicator,  visible  from  the  front  of  the 
unit. 

6.2.10  Packaging  Design 
General  Concept 

Estimates  were  made  of  electronics  needed  to  implement  one  com- 
plete channel  of  the  redundant  strapdown  INS.  From  the  numbers 
of  printed  circuit  boards  and  power  supply  components,  a pre- 
liminary packaging  design  was  conceived,  shown  in  figure  6-25. 

One  channel  of  the  redundant  strapdown  INS,  consisting  of  one 
gyro,  two  accelerometers,  supporting  electronics,  a computer  with 
I/O,  and  a power  supply  is  expected  to  fit  within  the  dimensions 
of  0.36  m x 0.11  m x 0.19  m,  and  weigh  approximately  5.9  Kg. 
Cam-lock  handles  are  used  to  engage  the  rear— mounting  connector 
and  lock  the  unit  in  place. 

A mechanism  is  required  to  withdraw  the  instrument  block  to  allow 
the  unit  to  slide  freely  into  or  out  of  a holding  chassis/mount 
during  maintenance.  For  this  purpose,  the  instrument  block  is 
attached  to  the  chassis  by  means  of  a pivoted  lever.  The  pivot, 
shown  in  figure  6-25,  is  fixed  to  the  chassis. 

During  insertion  or  removal,  the  return  spring  causes  the  instru- 
ment block  to  be  held  so  the  alignment  feet  are  kept  within  the 
unit.  When  the  unit  is  locked  in  place,  the  engagement  lever  is 
depressed  by  external  means,  causing  motion  of  the  instrument 
block,  in  the  direction  shown  in  figure  6-25.  The  alignment  feet 
then  protrude  from  the  side  of  the  unit  to  engage  a precision 
alignment  block  for  precise  registration  between  gyros  and  to 
the  aircraft. 
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Figure  6-26  shows  one  of  the  Inertial  Navigation  Modules  (INM) 
installed  into  a common  chassis/mount.  The  orientations  of  the 
other  three  INM's  are  rotated  90°  from  each  other  to  provide  the 
required  gyro  axis  skewing.  An  actuator  assembly  on  the  front 
of  the  chassis/mount  is  used  to  depress  the  engagement  lever 
within  each  INM  following  installation.  The  INM  instrument  block 
is  then  pressed  against  a central  alignment  block  in  the  center 
of  the  chassis/mount  assembly. 

The  actuator  assembly  and  alignment  block  are  more  clearly  shown 
in  figure  6-27.  The  90°  rotation  of  the  INM  rectangular  shape 
leaves  a hollow  core  in  the  chassis  mount.  This  area  is  then 
available  for  installation  of  the  actuator  assembly  and  alignment 
block.  Figure  6-27  also  shows  a view  of  instrument  blocks  in  the 
withdrawn  and  depressed  conditions. 

Figure  6-28  shows  the  G-6  gyro  and  A-1000  accelerometers  with 
the  remainder  of  the  instrument  block.  A printed  circuit  card 
would  also  be  attached  containing  critical  portions  of  the 
rebalance  loops.  Thus  these  components  would  thermally  track 
the  instruments,  avoiding  the  need  for  separate  calibration. 

The  size  of  the  entire  f ai 1— op/fail— op  redundant  INS  is  expected 
to  be  0.33  m x 0.33  m x 0.36  m.  Weight  would  be  under  28  Kg. 
Elaborate  measures  were  not  taken  for  size  reduction  since  low- 
cost  is  a major  system  design  requirement. 

Instrument  Alignment  Mechanism 

Alignment  from  gyro-to-gyro  is  required  to  be  better  than  20  arc 
seconds,  including  long  term  effects  of  handling  by  maintenance 
personnel.  The  baseline  design  was  selected  to  provide  proximity 
between  instruments  thus  minimizing  bending  between  modules  due 
to  temperature  gradients  or  g-loading. 

Alignment  repeatability  requirements  will  dictate  the  final 
design  of  the  alignment  mechanism.  Forces  on  the  block  stemming 
from  the  actuator  must  be  analyzed  with  regard  to  potential 
friction  forces  which  might  prevent  proper  seating  of  the  instru- 
ment block  alignment  feet  onto  the  chassis/mount  block.  Wear 
effects  and  thermal  gradient  susceptibility  need  consideration 
in  the  selection  of  material  and  finishes.  In  addition,  pres- 
sures produced  by  the  mechanism  would  need  to  be  analyzed  under 
vibration  conditions  to  avoid  angular  block-to-block  motions 
which  could  produce  system  errors. 

Alignment  of  the  instruments  relative  to  the  aircraft  is  much 
less  critical.  Six  arc  minute  alignment  accuracy  can  be  achieved 
using  normal  bore-sight  and  installation  techniques. 
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Figure  6-27.  Redundant  Strapdown  INS  Mount  Details 
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Thermal  Design 


Power  dissipation  within  each  INM  is  expected  to  be  under  135 
watts.  New  ARINC  600  cooling  provisions  need  review  for  the 
unique  installation  requirements  of  the  redundant,  skewed-sensor 

INS. 


The  preliminary  packaging  design  included  provision  for  the  dra 
ing  of  cabin  air  through  openings  in  the  front  of  each  INM. 

Some  sealing  of  the  face  of  the  INM  against  the  chassis/mount  is 
needed  to  avoid  air  pressure  losses.  Since  ARINC  cooling  has 
such  a low  pressure  drop,  highly  effective  sealing  is  not 
needed . 

The  cooling  air  flow  directly  impinges  electronic  components  and 
the  cover  of  the  instrument  block.  It  then  exits  at  the  rear  o 
the  chassis  mount,  which  forms  a plenum  between  units  for  even 
pressure  and  flow  distribution.  While  impingement  cooling  is 
undesirable  due  to  potential  contamination,  it  is  very  effective 
Installation  of  filters  on  the  front  of  each  INM,  as  used  on 
present  commercial  INS,  would  prevent  some  of  the  internal 
contamination.  Other  methods  should  be  reviewed  m the  final 
design  for  optimum  balance  between  maximum  component  temperature 
(and  thus  reliability) , contamination  and  unit  cost. 


Structural  Design 

Sufficient  structural  rigidity  must  be  provided  to  avoid  self- 
destruction  or  damage  during  the  normal  and  emergency  shock  and 
vibration  incurred  during  flight  and  handling.  The  preliminary 
design  has  not  included  analysis  for  these  factors.  However, 
the  general  concepts  and  size  are  expected  to  apply  for  t e 
required  environment. 


Special  Test  Equipment  Constraints 

The  equipment  used  in  the  factory  for  calibration  of  an  INM 
includes  a high-cost,  computer-controlled  rate  table.  In  order 
to  defray  cost  of  this  item,  it  is  essential  that  it  be  fully 
occupied,  day  and  night.  It  is  thus  also  essential  that  the 
capability  of  calibrating  more  than  one  INM  at  a time  be 
provided . 

The  volume  and  form  available  on  this  table  is  limited.  It 
appears  on  a preliminary  basis  that  3 INM’s  can  be  installed  on 
the  table  side-by-side.  There  is  no  room,  however,  to  include 
mounting  hardware  between  units  for  the  side-engagement  of  the 
instrument  block.  It  would  be  preferable  to  provide  instrument 
block  engagement  at  the  rear  or  connector  end  of  the  INM  if 
possible.  This  will  require  further  analysis  during  the  final 
design  phase. 
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6.3  Software  Design 

The  major  divisions  of  software  are: 

a.  Instrument  Compensation 
t>  • FDI  - Design  Equation 

c.  Coordinate  Conversion 

d.  Navigation 

These  major  divisions  have  been  further  divided  into  smaller 
blocks  of  software  to  increase  computational  throughput.  Fig- 
ure 6-29  illustrates  the  minor  software  blocks  and  denotes  the 
repetition  rates. 

The  INM  software  has  been  organized  to  enable  interchangeability 
of  computers.  Only  the  plug-in  instrument  calibration  coeffi- 
cient programmable  read-only  memory  (PROM)  would  be  a unique 
circuit.  Since  the  software  in  each  INM  is  interchangeable, 
some  means  of  identifying  the  particular  position  in  the  semi- 
octahedron is  necessary.  This  is  accomplished  by  hard-wire 
programming  of  the  system  interconnection  harness.  The  system 
harness  is  wired  into  a computer  input  discrete  word.  Upon  power 
turn-on  the  computer  program  pre-alignment  routine  will  initialize 
pointers  to  enable  branching  to  the  section  of  software  pertinent 
to  the  individual  INM. 

6.3.1  Computational  Considerations 

Assuming  that  a 16-bit  diqital  computer  is  utilized  for  this 
application,  a standard  set  of  double  precision  instructions  is 
required.  In  addition,  a hardware  double  precision  (32  x 32) 
multiply  is  very  useful. 

A computer  throughput  of  198,000  instructions  per  second  is 
required  to  perform  the  redundant  strapdown  INS  problem  with  a 
double  precision  multiply  instruction  along  with  the  instruction 
mix  of  table  6—6.  if  this  DMPY  instruction  were  not  available, 
approximately  460,000  instructions  per  second  are  required  with 
the  instruction  mix  of  table  6-6,  using  normal  programming  tech- 
niques. These  throughput  estimates  are  based  on  actual  LN-50 
coding . 

Applying  this  same  instruction  mix  to  a state— of —the— art  computer 
in  table  6-7,  results  in  a duty  cycle  estimate  (the  ratio  of  the 
strapdown  throughput  requirement  to  the  computer  throughput 
capability)  of  60  percent.  Note  that  if  a double  precision  multi- 
ply instruction  were  not  available,  the  computer  would  be  quite 
marginal  in  this  application.  However,  with  this  instruction, 
approximately  132,000  spare  instructions/second  are  available 
other  computations,  assuming  the  same  instruction  mix. 
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TABLE  6-6.  INSTRUCTION  MIX  FOR  REDUNDANT  STRAPDOWN  INS 


Type 

Percentages  With 
Double-Mu 1 tiply 
Instruction 

Percentages  Wi thout 
Double-Mul tiply 
Instruction 

Load/S  tore 

11.9 

20.3 

D- Load/S tore 

31 . 8 

18.2 

Copy 

5.5 

7.4 

Exchange 

4.2 

1.6 

D-Shif  t 

9.1 

14.0 

Add/Sub 

10.5 

9.4 

D-Add/Sub 

13.1 

10.4 

Multiply 

6.4 

10.2 

D-Mul tiply 

5.5 

— 

Divide 

0.6 

0.2 

Transfer 

1.4 

8.3 

6-3.2  Equation  Summary 

The  following  paragraphs  summarize  the  equations  of  the  flight 
software.  The  coordinate  frames  and  a glossary  are  included. 
Preliminary  computer  software  flow  charts  are  presented  in 
Appendix  H. 

6. 3.2.1  Instrument  Compensation 

Figure  6-30  illustrates  the  compensation  computations  per  single 
channel.  The  gyros  are  compensated  for  the  following  terms: 

a.  Scale  factor  linearity 

b.  Scale  factor  temperature  sensitivity 

c.  Sensitive  axes  misalignment 

d.  Inertia  dynamic  compensation 

e.  Mass  unbalance  drift 

f.  Mass  unbalance  temperature  sensitivity 

g.  Bias 

h.  Bias  temperature  sensitivity 
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TABLE  6-7.  DUTY  CYCLE  ESTIMATE  FOR 
A STATE  OF  THE  ART  16-BIT  COMPUTER 


Hardware  D-Multiply 

Software 

D-Multiply 

„ Ex . Time 

TyPe  (nsec) 

Mix 

Ex.  Time/ 
Ins . 

w . Ex.  Time/ 

Mix  _ 

Ins . 

Load/Store 

1.4  X 

0.119 

= 0.1904 

0.203 

0.3248 

D-Load /Store 

2.2 

0.318 

0.7632 

0.182 

0.4368 

Copy 

1.4 

0.055 

0.088 

0.074 

0.1184 

Exchange 

1.4 

0.042 

0.0672 

0.016 

0.0256 

D-Shift 

2.2 

0.091 

9.4368 

0.140 

0.672 

Add /Sub 

1.4 

0.105 

0.168 

0.094 

0.1504 

D-Add/Sub 

2.2 

0.131 

0.3144 

0.104 

0.2496 

Multiply 

3.2 

0.064 

0.2688 

0.102 

0.4284 

D-Multiply 

11.0 

0.055 

0.66 

- 

- 

Divide 

3.4 

0.006 

0.0216 

0.002 

0.0072 

Transfer 

1.0 

0.014 

0.0504 

0.083 

0.2988 

|jsec/avg  instr 

3.0288 

2.712 

Throughput 

= 330,164  instr/sec 

368,732 

instr/sec 

Duty  Cycle 

198,000 

- 330,164  " 60 

.0% 

460,000 

368,732 

= 125% 

The  accelerometers  are  compensated  for  the  following  terms: 

a.  Scale  factor 

b.  Scale  factor  temperature  sensitivity 

c.  Sensitive  axes  misalignment 

d.  Bias 

e.  Bias  temperature  sensitivity 
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Equations  1 to  18  describe  the  compensation  equations.  Equa- 
tion 19  provides  the  components  necessary  for  axis  misalignment 
correction.  Equation  20  transforms  the  2-axis  instrument  out- 
puts to  the  body  frame.  Reference  table  6-12  for  a definition 
of  symbols. 

GYRO  SCALE  FACTOR 


+ 

s 

+ 

+ 

s 

• Ad( 

GX1 

GX2 

At 

s‘ 

+ 

s„_,„ 

• A0< 

GX1 

GX2 

At 

++ 

s 

+ 

++ 

. Ad( 

GX1 

GX2 

At 

s~~ 

+ 

s“ 

. A d 

L GX1 

GX2 

1 

At 

• Sgn^SGX> 


NORMAL  MODE 


HIGH  RATE  MODE 


(1) 


[SGY1  + SGY2  * A 6Gy] 

• Sgn^eGY>) 

At 

[SGY1  + SGY2  0Gy] 

• Sg„^«GY>' 

At 


NORMAL  MODE 


(2) 


V [SGY1  + SGY2  **6Gy]  * Sgn^0GY^ 

At 

+ [SGY1  + SGY2  * A ^Gy]  * Sgn(A0GY) 


At 


HIGH  RATE  MODE 


NOTE:  S (Ad  ) = 1 

gn  GX 


— ; ^ ( if  Ad  is  negative. 

Sgn<*«GX>  * ° > =* 
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GYRO  COMPENSATION 


SCALED  GYRO  RATES 


A ~ SGX  * A °GX 
A \ - SGY  • A9GY 


(3) 


TORQUER  AXIS  TRANSFORMATION 

A Orx  - 6gxx  . A 0X  + 6Gxy  . A 0 Y 

A °TY  ~ 6GYX  ' A 0X  + 6GYY  «A  0Y 

INERTIA  COMPENSATION 

A°IX  _IG  ^AftTY  _A0TY  ) 
A»IY  = Tc  • (A0TXn  -AflTYn_1> 


(4) 


(5) 


SPIN-AXIS  ALIGNMENT 


A e 

= A(9 

7 

A 0 n_1 

PX 

IX 

GX 

”s 

A °PY 

= A Q + 

IY 

7gy  ‘ 

*-! 

1 

C 

c/> 

<1 

(6) 

G SENSITIVE  DRIFTS 

A"mx  = Afl>>x  * V Avcx  * "xv  • Aucy  - "xz  • a 


V, 


n-  1 


A(W  = A9py  * \x  • Avcx  * "yy  • Avcy  * \z  •Avs"'1  (7) 
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GYRO  COMPENSATION 
NON-G  SENSITIVE  BIASES 

A eCY  - - by  . At 

ACCELEROMETER  COMPENSATION 
SCALED  INCREMENTAL  VELOCITIES 


AV 

X 

= SAX 

• avax 

AV 

Y 

= SAY 

• avay 

(9) 

AXIS  ALIGNMENT 


AV 

AV 


TX 

TY 


6AXX 

6ayx 


AV_  + 

6 

AV„ 

+ 6 . AVn_1 

X 

AXY 

Y 

AXZ  S 

n- 1 

AV  + 
" X 

6ayy 

AV 

Y 

+ 6ayz  * AVs 

(10) 


BIAS 


AV  = AV  * + A » At 

CX  TX  BX  ** 


avcy  = aVty  + aby  • At 


(11) 
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INSTRUMENT  TEMPERATURE  COMPENSATION 


DSGX  = 

SGTXO 

+ 

SGTXl(TGX) 

+ 

SGTX2(TGX)2 

(12) 

DSGY  = 

SGTYO 

+ 

SGTY1 ( TGY ) 

SGTY2 ( TGY ) 2 

BX  = 

BGTXO 

+ 

BGTXl(TGX) 

+ 

BGTX2 ( TGX) 2 

(13) 

By  = 

BGTYO 

+ 

BGTYl ( TGY ) 

+ 

BGTY2 ( TGY ) 2 

MXX  = 

MGTXO 

4 

MGTX1 ( TGX ) 

+ 

MGTX2 ( TGX ) 2 

(14) 

Myy  = 

MGTYO 

+ 

MGTY1 ( TGY ) 

+ 

MGTY  2 ( TGY ) 2 

SGX1  = 

sgxo 

+ 

DSGX,  SqxI 

= 

SGX0  + DSGX 

(15) 

SGY1  = 

Sgyo 

DSGY , SqyI 

= 

SGXO  + DSGY 

(16) 

Accel 


Sax 

= SATXO 

+ 

SATXl ( TAX ) 

+ 

SATX2  ( TAX ) ^ 

(17) 

Say 

= SATYO 

+ 

SATYl(TAY) 

+ 

S ATY  2 ( TAY ) 2 

abx 

= BATXO 

BATX1 ( TAX ) 

+ 

BATX2 ( TAX) 2 

(18) 

aby 

= BATYO 

BATY1 ( TAY ) 

4- 

BATY2 ( TAY ) 2 

TRANSFORMATIONS 


Spin  Axis  Components 

n-1 


a e 


AV„ 


n-1 


s • ( a e b)n_1 

S • (AV,  )n_1 

JD 


(19) 
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Body  Components 


= [*  7] ; 
* [x"  7] ' 


-cos  45°  -sin  45°  A0CX 


+ sin  45°  -cos  45° 1 . A8CY 


„ V I -cos  45°  -sin  45°  'AVCX 


sin  45°  -cos  45°  .AVCY 


NOTE:  Refer  to  Table  6-8  for  definition  of(X,  Y,  S)  vectors. 


TABLE  6-8.  SEMI -OCTAHEDRON  UNIT  VECTORS 


EDGE  VECTORS 


p • 

12* 

•72  t-1’ 

o, 

1) 

e23: 

72  <-*’ 

1 

-1. 

0) 

e34: 

— (-1- 

1 

o, 

-1) 

e41: 

— (-1- 

1 

1, 

0) 

®13: 

— < °' 

1 

It 

-1) 

e24: 

— < °> 

1. 

1) 
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6. 3. 2. 2 Failure,  Detection  and  Isolation 

Figure  6-31  illustrates  the  mechanization  of  the  gyro  Failure, 
Detection  and  Isolation  software.  An  equivalent  set  of  software 
exists  for  the  accelerometers,  the  differences  are  in  the  filter 
time  constants,  detection  levels,  and  scaling. 


GYRO  PARITY  EQUATIONS 


Ap  n 

gl2 

■3 

II 

^ bl 

Ap  n 

g23 

— *v  2 

(A0b2 

Ap" 

g34 

= V2 

^b3 

Apn 

g41 

= V2 

<^®b4 

a I"1 

A P , o 
gi  3 

= sl2 

<“bl 

A p n 
g24 

= vT 

<A»b2 

G 1 2 

-^6b2 

ei2^ 

e23 

-^b3  ' 

’ * 23  > 

e34 

" A0b4  ’ 

*34> 

G41 

*41  > 

e!3 

-^b3  • 

' *13> 

*24 

-A®b4  * 

*24> 

PARITY  EQUATIONS  ( 21 ) 


Lgi 


p"?1  +Ap  n ,| 
gij  gij 


i f j 


L . . = 1 if 
gij 


p . . 
9 


> 6 g 


(Lgl2  9 Lg41 ^ 


(L  © L ) © (L 
v g!2  gl  3'  v g41 


<Lgl2  G Lg23> 


(Lgl2  ® Lg24>  • <L. 


g23 


(L  0 L * 
' g23  g34' 


<L923  0 Lgl3>  ® <L 


g34 


(L934  0 Lq41> 


<L934  ° L924>  ® (L 


g41 


FIRST  ORDER  FILTER  ( 22  ) 


© Lgl3>  GYRO  #1  FAIL  (23) 

0 Lg24*  GYRO  #2  FAIL 

O L ) GYRO  #3  FAIL 
gl3' 

O L _ J GYRO  #4  FAIL 
g24' 


NOTE: 


1.  0 = LOGICAL  'AND'  , ® = LOGICAL  'OR' 

2.  Refer  to  table  6-10  for  definition  of  e • • vectors 
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Figure  6-31.  Gyro  Failure  Detection  and  Isolation  Block  Diagram 
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GYRO  PARITY  EQUATIONS 


L =■  L 0 (L  © L ) ® L 0 (L  O L ) 
gng  g!2  gl  g2  g23  g2  g3 
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ACCEL  PARITY  EQUATIONS 
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e12) 

Al>n 
a2  3 

= \P 
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e23^ 
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741> 

Apn 
al  3 
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a 24 
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!,  3,  4 i j j J 
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if  Ip  . .1  ^ $a 
1 a±3l 

PARITY  EQUATIONS  (25) 


FIRST  ORDER  FILTER  (26) 


NOTE:  0 = LOGICAL  ’AND'  © = LOGICAL  'OR* 
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ACCEL  PARITY  EQUATIONS 


ACCEL  #1  FAIL  (27) 
ACCEL  #2  FAIL 
ACCEL  #3  FAIL 
ACCEL  #4  FAIL 


ACCEL  ( 28 ) 

PARITY 

equation 

ERROR 

DISCRETE 


NOTE:  © = LOGICAL  ’AND'  © = LOGICAL  'OR* 


6. 3.2. 3 Design  Equations 

The  design  eguations  combine  the  outputs  of  two  instruments  in  a 
least  square  solution  to  form  the  total  body  axes  inertial  rates. 

Equations  (29)  and  (30)  summarize  the  equations  in  vector  form. 
The  weighting  factors  are  defined  in  table  6-10.  The  logic 
variables  SG12,  SG13,  etc  are  set  to  1 or  0 according  to  the 
logic  formulated  in  table  6-9. 


Lang  = Lal2  ® <Lal  0 La2>  * La23  0 <La2  ® La3) 
® La34  0 <La3  0 La4>  ® La41  0 <L,4  0 4al> 


Lal  3 0 <Lal  ® L,3>  ® La24  ® <La2  ® La4> 


<Lal2  ® La41> 


<Lal2  0 Lal3>  ® < La41  0 Lal3> 


(Lal2  ® La23^ 


*Lal2  ° La24^ 


<La23  0La24> 


<La23  0 La34> 


<La23  0 Lal3> 


' L „ „ G L , „) 
1 a 34  a!3' 


^La34  ° La24^ 


(La41  ° La24> 


_ _ 4 (29) 

A6b  = W12*A6bl  + A0b2)SG12 

+ w13(^0bl  + ^b3^SG13 

+ wi4(A9bl  + A0b4)SG14 
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AV^  = W,  _ ( AV,  , + AV,  _ )SVl2 


12  bl 


b2 


( 30) 


+ W.  -(  AV,  . + AV,  ) SVl  3 


13  bl 


b3 ' 


+ Wlyl(AVwl  + AV,  , ) SV14 


14  bl 


b4' 


Note:  Design  equations  are  written  for  INM-1,  similar  sets 

apply  for  INM2-4  as  indicated  in  table  6-11. 


TABLE  6-9.  INSTRUMENT  PAIR  SELECTION  VS  FAILURE  INDICATION 


CHAN 

FAILURE 

INDICATION 

0 

1 

2 

3 

4 

1&2 

1&3 

1&4 

2&3 

2&4 

3&4 

1 

a 

1,2 

1,3 

1,2 

1,2 

1,3 

1,2 

1,4 

1,3 

2 

2,3 

2 , 3 

2,3 

2,4 

2,3 

2,3 

2,3 

2,4 

2,3 

3 

3,4 

3,4 

3,4 

3,4 

3,1 

3,4 

3,4 

3,2 

3,4 

3,1 

3,1 

4 

4,1 

4,2 

4,1 

4,1 

4,1 

4,3 

4,2 

— 

4,2 

4,1 

4,1 

4,1 

6. 3. 2.4  Coordinate  Converter 

Figure  6-32  illustrates  the  strapdown  conversion  computations. 
The  integration  algorithm  listed  under  equation  set  (31), 
represents  a partial  5th  order  Taylor  series  quaternion  integra- 
tion algorithm.  The  total  quaternion  integration  procedure  is 
accomplished  at  two  rates,  the  body  rate  integration  performed 
at  64/sec  and  the  computational  frame  rate  integration  at  8/sec. 
The  velocity  transformations,  equation  (33)  performed  at  64/sec. 
Note  that  the  quaternions  are  converted  to  a direction  cosine 
matrix  followed  by  a matrix  multiply  to  accomplish  the  velocity 
transformation . 
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TABLE  6-10.  LEAST  SQUARES  WEIGHTING  FACTORS 


W12 

' [S1+S2]'’ 

= 1/4 

'4  0 2*1 
0 3 0 
2 0 4j 

W13 

■ [St  + %] '' 

= -1/4 

"3  0 0] 
0 4 2 
.0  2 4j 

W23 

" [S2  + S3]'’ 

= 1/4 

"4-2  0"l 
-2  4 0 

.0  0 3j 

w24 

- [s2  + s4]'' 

= 1/4 

'3  0 0" 
0 4-2 
.0  -2  4. 

W34 

" [S3  + S4]  _1 

= 1/4 

'4  0 -2"l 
0 3 0 
;2  0 4j 

w14 

* [Sl+S4]'' 

= 1/4 

4 -2  0] 
-2  4 0 
0 0 3j 

DEFINITION  OF 


(GYRO  OUTPUT 
RATE  , 


/ INPUT \ 

Irate  I 


(PROJECTION  OF 
INPUT  RATE  ALONG 
SPIN  AXIS 


PROJECTION  OF  INPUT 
ON  PLANE  NORMAL  TO 
SPIN  AXIS  * 
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GYRO  SAMPLES 


DIFFERENCE 

APPROXIMATIONS 


Note:  A6a  and 


QUATERNION  INTEGRATION 
ALGORITHM 
Q = QZ/2 


(n+1/2) At 
udt 

nAt 


/ 


{ n+1) At 
wdt 


(n+1/2) At 


(31) 


A0g  are  two  samples  of  40^ 


313 


403314 


DIRECTION  COSINES 
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COORDINATE  CONVERSION 


1/2=c  n . 
XX 

n + 1/2 
AVXb  + 

c2y  • 

Sb+ 

1/2 

+ C 

n 

XZ 

-2/  1/2 

1/2  _ pn 
YX 

■ 4V"  + 
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• iv?b+ 1/2  + 
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ZX 
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Xb 

1/2 

- c2v 
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cn 

ZZ 
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1/2  (33) 

NAVIGATION 

VELOCITY  SUMMATION 

v"  + 
XN 

1/2 

= v11 

XN 

- 1/2 

1/2 

V°  + 
YN 

1/2 

= v” 

YN 

- 1/2 

+ 4V?n+ 

1/2 

V°  + 
ZN 

1/2 

= 

ZN 

- 1/2 

+ 1v2n+ 

1/2 

(34) 
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6. 3. 2. 5 Navigation 

Equation  (35)  represents  the  integration  of  the  navigation  frame 
rates,  comparable  to  gyro  torquing  for  a gimbaled  platform 
inertial  navigation  system. 

The  inertial  navigation  equations  are  the  standard  set  common  to 
all  Litton  inertial  navigation  systems.  The  alignment  equations 
again  use  a proven  technique  common  to  Litton  inertial  navigation 
systems.  It  consists  of  two  independent  3rd  order  leveling  loops 
with  Kalman  gains.  The  technique  accomplishes  simultaneous 
leveling  and  gyrocompassing  with  a minimum  of  computations. 

Figure  6-33  illustrates  the  3rd  order  Baro-Inertial  Vertical 
Channel.  It  is  modified  to  compensate  for  barometric  altimeter 
errors . 
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V n = v n 
X X 


V N = V N 
Y Y 


V N = V N 

z z 


1 

1 

1 


NAVIGATION  VELOCITY 
+ V^  + ( VXCR  + VXCL ) • Atjj 

+ V^  + ( VYCR  + VYCL)  • AtN 

+ V^  + (VZCR  + VZCL)  * AtN 


(36) 


ALIGNMENT  EQUATIONS 
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NAVIGATION  DIRECTION  COSINES 
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REl 
RE  2 
RE  3 


NAVIGATION  RATES 

WXN  = - (WX  + WXC  + BXC ) 
WYN  = - (WY  + WYC  + BYC) 
WZN  = - (WZ) 


WXC , WYC  = 0 : NAV 

BXC , BYC  = 0 MODE  ' J ' 

MISCELLANEOUS  CALCULATIONS 
ATTITUDE 

PITCH  = SIN-1  ( CZY ) 

-1  / — CZX\ 

ROLL  - TAN  ( czz  ) 

(— CXY \ 

CYY~  / 

HEADING  = - AZIMUTH  - ALPHA  { 40  ) 

RADII  OF  CURVATURE 

= I . - I • hb  - f * (l  - 3 • (B12) 2 - ( B22) 2)  | 

= i . A - i • h,  - f • (l  - 3 • ( B22 ) 2 - ( Bl  2 ) 2 )) 

= i . (2  • f • Bl 2 • B22)  (41) 

a 

CORIOLIS  ACCELERATION 

VXCR  = ( 2 * WZN  • VY ) - ( 2 * WYN  - RHOY ) • VZ 

VYCR  = (2  • WZN  • VX)  + (2  • WXN  - RHOX)  * VZ 

AZCR  = V (RHOY  + 2QB22)  - Vy  (RHOX  + J2B12)  (42) 

A 
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LONGITUDE  = 

LATITUDE  = 
ALPHA  = Tan 


POSITION  .CALCULATIONS 


Tan 


-1 


B31 


Bll  • B22  - B12  • B21 


Sin  1 - (B32) 


-1  B12 
B22 


EARTH  RATES 


"xs  = fi(B12) 

wys  = ft ( B22 ) 
uzs  = ® ( B32  ) 

NAVIGATION  DIRECTION  COSINE  INITIALIZATION 


Bll  — cos(a)  cos  ( A. ) - sin(A)  sin(4>)  sin(o) 

B21  = -cos(A)  sin(o)  - sin(A)  • sin(«f>)  - cos(a) 

B31  = sin(A)  • cos(4>) 

B21  = sin(o)  * cos(4>) 

B22  = cos('>)  • cos ( 4> ) 

B32  = sin  ® 


where  A = Longitude 

= Latitude 
o = Alpha 
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BARO- INITIAL  COMPUTATIONS 

HBDOT  = (HB  - HBO)/DT 

KTA  = (]/TH)/(l  + (HBD0T  )2) 

K1  = 3 • (KTA) 

K2  = 4 • (KTA)2  • + — 'q° 

a 

K3  = 2 • (KTA)3 

K4  = ( HBDOT )2/( EHBDOT2  + HBDOT2) 
S4  = S4  + K4  • HBDOT  - DT 
DH  = (HB  - HBO)  - S4 
HBO  = HB 

S3  = S3  + K3  • DH  • DT 

Vz  = Vz  + (S3  + K2  • DH)  • DT 

h = h + (Vz  + K]  • DH)  • DT 

g = go  (1  + Beta  • B32  -— ) 

a 


6-3. 2. 6 Coordinate  Frames  and  Glossary 

Figures  6-34  and  6-35  illustrate  the  pertinent  coordinate 
frames  for  the  preceding  equations.  Table  6-11  summarizes  these 
coordinate  frames. 

Table  6-12  is  a glossary  of  major  terms  in  these  equations. 

6.3.3  Computer  Resource  Estimates 

With  the  INM  software  tasks  broken  down  as  illustrated  in  fig- 

29,  an  estimate  of  memory  and  computer  duty  cycle  require- 
ments using  the  computer  characteristics  of  table  6-7  has  been 
made.  The  results  are  listed  in  table  6-13.  The  estimates  of 
duty  cycle  requirements  are  conservative.  Various  means  of 
reducing  computation  time  will  be  reviewed  during  the  final 
design  phase  of  the  redundant  strapdown  INS. 
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Figure  6-34.  Semi-Octahedral  Coordinate  Frames 
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Figure  6-35.  Navigation  Frame  Relationship 
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TABLE  6-11.  COORDINATE  FRAMES 


X 


B' 


B 


x! 

l 


s ! 
i 


x . « 
i 


s . 

1 


X,  y , z 


Body  Frame:  X-forward  along  airframe 

longitudinal  axis.  Y along  right 
wing  and  Z-axis  down 

Instrument  physical  axis  of  the  ith 
inertial  navigation  module:  the  s| 

axis  is  normal  to  the  ith  surface 
of  a semi— octahedron ) , the  x|  and 
y i axis  lie  in  the  ith  surface  such 
tliat  the  bisector  of  the  x^  and  y^ 
axis  is  perpendicular  to  the  base 
of  the  semi -octahedron . 

Instrument  axis  of  ith  inertial 
navigation  module:  this  axis  is 

obtained  by  rotating  the  physical 
axes  (xi,  yi.  si ) about  the  -s^ 
axis  through  -135°  to  make  the 
axes  parallel  to  an  outside 
semi-octahedral  edge 

Computational  frame:  locally 

leveled,  with  y-axis  displaced 
from  geographic  north  through 
azimuth  angle  1 a 1 . z-axis  is  up. 

Earth  fixed  frame:  XE-Zg  plane 

coincident  with  earth's  eguatorial 
plane,  Ze  axis  passing  through 
Greenwich  meridian,  x,  y,  z frame 
obtained  by  rotations  through 
angles  \ and  about  Ye  and  Xe  and  final  y 
through  ,ot'  about  z axis. 
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TABLE  6-12.  GLOSSARY 


Symbol 

Definition 

a 

Earth’s  equatorial  radius,  6378.163  Km 

abx'  aby 

Accelerometer  biases 

BATXO,  BATXl , BATX2 

Accelerometer  bias  temperature 
sensitivity  coefficients 

Beta 

Gravity  constant  0.0517993209  Km/Sec2 

BGTXO,  BGTXl,  BGTX2 

Gyro  bias  temperature  sensitivity 
coefficients 

B , B 
x y 

Gyro  biases 

Bll , B21 , B31 , B12, 
B22,  B32 

Earth  - Navigation  frame  direction 
cosines 

VGX ' yGY 

Gyro  spin  axis  misalignment  coefficients 

Cij,  i,  j = 

x#y  ,z 

Body  to  navigation  frame  direction 
cosines 

dZXX‘,  dAXY' 

4axz 

Accelerometer  misalignment  coefficients 

dZYX,  dAYY, 

^AYZ 

dGXX'  dGYY' 

dGYX  ‘ dGXY 

Gyro  torquer  misalignment 

n-1  n-1 

A0  , M , 
bx  by 

n-1 

A(9 

bz 

Body  rates  from  previous  iteration 

^cx ' '^cy 

Compensated  gyro  rates  about 
instrument  axes 

^gx ' ^gy 

Raw  outputs  of  gyros 

. n-1 

A^s 

Inertial  rate  about  spin  axis  from 
last  iteration 
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TABLE  6-12.  GLOSSARY  (cont) 


Symbol 

Definition 

*Vax'  Way 

Raw  outputs  of  accelerometers 

*vbx'  JVby'  *Vbz 

Incremental  body  velocities  along 
body  axes 

av""1 

S 

Incremental  inertial  velocity  along 
s - axis  of  accelerometer 

4V  * 4V 
xn  yn 

Incremental  inertial  velocities  in 
navigation  frame 

E HBDOT 

Emperically  derived  constant  for  baro- 
inertial  loop 

f 

_3 

Earth's  flattering,  3.3541005459x10 

g,  GEE 

Vertical  component  of  Earth's  gravita- 
tional field 

Equatorial  gravity.  At  equator  , sea 
level,  9.780270477  Km/sec  2 

h 

Inertial  altitude 

I 

g 

gyro  inertial  compensation  coefficient 

kl,  k2 , k3,  k4 

Baro-inertial  loop  gains 

MGTXO , MGTXl,  MGXTX2 

Gyro  mass  inbalance  temperature 
sensitivity  coefficients 

”XX'  ^XY ' \z'  ^XY'  “YY 
*YZ 

Q 

Gyro  direct  and  quadrature  mass 
inbalance  coefficients 

Earth's  rate,  15.041067  °/hr 

Sax'  Say 
s + s + 

^GXl  ' GX2 

Accelerometer  scale  factors 

Gyro  scale  factor,  normal  mode,  for 
positive  inputs 

325 


403314 


TABLE  6-12 . GLOSSARY  (cont) 


SGX1' 

SGXV 

SGX1' 

SGX'  S 
SATXO, 


Symbol 

SGXZ 

S ++ 

^GX2 

SGX2 

GY 

SATXl , SATX2 


Definition 


Gyro  scale  factor,  normal  mode,  for 
negative  inputs 

Gyro  scale  factor,  high  rate  for 
positive  inputs 

Gyro  scale  factor,  high  rate  mode, 
for  negative  inputs 

Total  gyro  scale  factor 


Accelerometer  scale  factor  temperature 
sensitivity  coefficients 


SGTXO , SGTXl , SGTX2 


GX 


AX 


V 

x 


/ 


V 

z 


Gyro  scale  factor,  temperature 
sensitivity  coefficients. 

Normalized  relative  gyro  and  accelerometer 
temperature  input 

Ground  velocities  in  navigation  frame. 


V , V , V 
XCR  YCR  ZCR 


Coriolis  acceleration  correction 
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6.3.4  Future  Software  Refinements 

The  flow  charts  presented  in  Appendix  H include  all  major  pro- 
cessing requirements.  There  are  additional  functions  which  would 
be  considered  for  the  software  of  a final  design.  • They  do  not 
represent  a major  impact  on  duty  cycle  and  word-count. 

The  details  of  processing  of  variables  for  output  to  other 
avionics  and  self-test  implementations  have  not  been  included  in 
the  flow  charts,  for  example.  Special  formatting  and/or  filter- 
ing requirements  need  to  be  determined  in  consultations  with 
potential  users  and  would  vary  with  the  detailed  hardware  design 
of  the  redundant  strapdown  INS.  Rough  computer  estimates  have 
been  included,  however. 

Gyro/accelerometer  selection  in  design  equations  is  based  on  only 
one  alternate  rather  than  the  two  described  in  paragraph  4.5.1 
this  report.  The  decision  to  use  the  second  alternate  for 
improved  fail-safe  operation  during  the  third  system  failure  was 
reached  too  late  for  incorporation  into  flow  charts. 

There  are  various  refinements  to  the  redundancy  management  dis- 
cussed in  Section  IV,  not  incorporated  into  flow  charts,  but 
worthy  of  future  consideration.  These  refinements  include: 

а.  Processing  of  filtered  parity  equation  outputs,  including 
compensation  of  nominal  gyro  scale  factor  errors,  for 
improved  FDI  sensitivity  to  performance  degradations. 

б.  Derivation  of  error  probabilities  from  parity  equation 
outputs  to  determine  weighting  factors  for  use  by  exter- 
nal equipment  in  combining  the  three  or  four  channel 
output,  for  reduction  of  total  system  error  just  prior 
to  actuation  of  FDI  thresholds. 

c.  Transfer  of  the  FDI  filter  lag  to  a pure  integration 
following  detection  (but  not  isolation)  of  a drift,  for 
potential  noise  reduction  and  better  isolation 
sensitivity . 

d.  Reincorporation  of  a previously  failed  but  only  marginal 
gyro  to  resolve  three-gyro  isolation  ambiguity  or 
cover  a 3rd  failure,  for  improved  system  reliability. 

e.  Cross-feed  of  computer  output  tables  to  detect  computer 
transient  errors  and  reinitialize  quaternions  and  navi- 
gation solution,  for  improved  system  reliability  and 

as  an  aid  in  fault  isolation  between  the  computer  and 
external  I/O. 
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f.  Reinitialization  of  those  computers  using  an  instrument 
which  was  switched  out  by  redundancy  management  with 
information  from  a known  good  computer,  to  eliminate 
errors  which  needed  to  accumulate  to  trip  the  FDI 
mechanism . 

g.  Monitor  of  accumulated  position  and  velocity  updates 
from  the  external  computer  and  perform  redundancy 
switching,  for  elimination  of  degraded  gyros  and  flag- 
ging maintenance  personnel.  (This  could  be  done  by  the 
external  computer,  but  a self-contained  capability  may 
be  preferred . ) 

h.  Storing  various  data  at  the  time  of  a redundancy  manage- 
ment or  self-test  action,  such  as  self-test  results, 
vehicle  rates,  acceleration,  velocity,  attitude  and 
some  prior  time  history  of  parity  equations  (e.g., 

10  seconds) , for  use  by  maintenance  personnel  in  deter- 
ruination  of  repair  requirements • 

The  basic  navigation  function  may  also  be  augmented  with  refine- 
ments for  improved  performance  or  in-service  usability.  These 
refinements  include: 

a.  An  estimate  of  each  of  the  skewed— gyro  biases  can  be 
made,  following  each  ground  alignment  based  on: 

(1)  a North  level  bias  calculation  which  assumes 
knowledge  of  latitude  to  some  accuracy,  e.g., 

1.85  Km,  (since  aircraft  parking  heading  is 
generally  different  from  alignment  to  alignment, 
all  level  components  of  drift  gradually  get 
compensated)  , 

(2)  differences  between  each  channel's  computation  of 
aircraft  heading  during  gyrocompass ing  (aggregate 
heading  using  data  from  all  four  channels  should 
be  more  accurate  than  from  one  channel  alone) , 

(3)  the  difference  in  indicated  heading  from  the  end  of 
the  previous  flight  to  that  resulting  from  the 
following  gyrocompass  (azimuth  drift) , assuming 

the  aircraft  had  not  been  moved.  (Protection  against 
movement  by  means  of  a reasonableness  test  would 
be  needed.  Also,  normal  scale— factor  errors  con- 
taminate this  measurement,  but  it  may  be  sufficiently 
accurate  over  a number  of  flights.) 
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b.  The  various  indications  of  aircraft  pitch  and  roll  may 
be  averaged  to  improve  accelerometer  bias  errors. 
(Accelerometer  bias  is  a significant  contributor  to  the 
velocity  error  of  a strapdown  INS,  much  more  so  than  in 
a gimballed  INS.) 

c.  An  automatic  transfer  from  align  to  navigate  when 
accelerometer  outputs  cross  a threshold  is  often 
included  as  a protection  against  operator  error. 

d.  Factory  test  equipment  ( FTE)  can  be  simplified  by 
having  a special  counting  subroutine  in  the  airborne 
equipment  for  use  during  unit  calibration  prior  to 
delivery.  A trade-off  is  needed  to  compare  cost  of  FTE 
counters  versus  a small  amount  of  additional  airborne 
computer  memory. 

e.  A back-up,  pendulous  attitude  mode  could  be  added  for 
use  with  previously  switched  degraded  accelerometers 
or  gyros,  following  a third  failure  detected  and 
isolated  by  self  test,  for  improved  pitch/roll 
reliability. 
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VII.  FACTORY  TEST  EQUIPMENT 

7 . 1 Module  Testing 

Integration  and  acceptance  testing  is  performed  at  the  module 
level,  consistent  with  the  standardization  and  interchangeability 
concept  of  the  four  module  Redundant  Strapdown  System.  To  sup- 
port high  production  rates  economically  and  insure  consistency  and 
thorough  testing,  all  final  test  is  performed  on  automatic 
stations  supported  by  software  test  programs. 

7.1.1  Manufacturing  Flow 

Figure  7-1  represents  the  module  manufacturing  and  test  flow. 
Integration  or  "Build-Up"  is  the  assembly  of  assets  which  have 
been  tested  at  lower  levels  into  the  module  chassis.  Electronic 
cards  have  been  tested  on  card  testers,  harnesses  on  FACT  machines 
and  instruments  on  their  respective  gyro  and  accelerometer  test 
stations.  The  Manufacturing  Test  Procedure  (MTP)  is  performed  in 
two  parts  to  accommodate  the  special  requirements  of  instrument 
rate  testing  and  axis  alignment  calibration.  MTP  1A  provides 
a functional  test  of  the  module  and  specifies  a six  position 
"static"  calibration.  Testing  for  MTP  IB  is  performed  on  a Rate 
Calibration  Station  which  has  angular  rate  testing  capability. 

To  screen  for  component  and  assembly  problems,  all  modules  are 
run  through  a multi-cycle  hi-lo  temperature  burn-in.  The  temper- 
ature chambers  include  vibration  equipment  and  vibration  testing 
is  also  performed.  To  support  the  modules  during  this  period  a 
third  station,  the  Burn-In  Monitor,  is  utilized.  After  burn-in, 
the  Final  Acceptance  Test  is  run. 

7.1.2  Test  Programs 
Build  Up  Software  Program 

The  Build  Up  Program  executes  on  the  Load  Station.  Build  Up 
begins  with  inserting  subassemblies  or  groups  of  subassemblies 
into  the  chassis.  First  the  power  supply  is  inserted  and  checked 
for  voltage  levels  and  operation  of  automatic  shutdown  safety 
features.  Next  the  computer  is  added.  It  is  initialized  and 
allowed  to  execute  self-test  programs  first  and  when  these  are 
successfully  completed  to  drive  the  I/O  cards.  The  next  to  last 
assemblies  added  are  the  instrument  rebalance  electronics  which 
are  supplied  with  dummy  loads  to  insure  safe  operation  prior  to 
installation  of  the  final  subassembly,  the  instrument  block. 

This  step  by  step  procedure  assures  incrementally  good  assets  and 
inspection  of  intermediate  test  points  not  normally  accessible 
at  the  module  test  connectors. 
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The  final  operation  of  Build  Up  is  Trim.  For  the  INM  this  is 
primarily  setting  the  frequency  characteristics  of  the  instru- 
ment loops.  A frequency  response  is  made  of  each  loop  automati- 
cally and  the  computer  then  calculates  the  required  trim 
resistance  to  adjust  each  to  the  nominal.  With  this  information, 
the  module  is  returned  to  Operations  for  resistor  installation. 

Manufacturing  Test  Procedure  (MTP)  1A 

MTP  1A  begins  when  the  trimmed  module  is  returned.  The  test 
consists  of : 

a.  Turn-On  Test 

• Turn  on  sequence  timing. 

• Supply  voltage  and  test  point  monitor. 

• Performance  versus  time  from  start-up. 

b.  Computer  Diagnostics 

c.  Mode  Test 

• Test  of  the  module  operating  modes  Test,  OFF,  BITE, 
Forced  Hi-Rate  Mode 

d.  I/O  Tests 

• Tests  of  the  Lo  Speed  and  Hi  Speed  data  buses. 

• Test  of  input  and  output  discretes. 

e.  Instrument  loop  frequency  response 

• Verification  of  the  Build  Up  Trim. 

f.  Static  Calibration 

• Six  position  tests  to  determine  accelerometer  align- 
ment coefficients,  and  gyro  biases.  A skewed  hold- 
ing fixture  is  used  to  align  the  instrument  axes 
parallel  and  at  right  angles  to  vertical.  Constants 
determined  here  are  stored  for  later  insertion  into 
the  module  PROM. 

Rate  Calibration  Program,  MTP-1B 

Rate  Calibration  is  performed  on  the  Rate  Calibration  Station 
which  incorporates  a precision,  automatic  rate  table.  Four  units 
are  tested  concurrently  and  the  software  is  so  arranged  that  a 
module  may  be  loaded  independent  of  the  test  status  of  the  other 
modules.  Testing  consists  of  introducing  CW  and  CCW  rates  over 
precise  angles  and  measuring  the  instrument  outputs  and  the 
elapsed  time.  These  tests  are  performed  about  the  gyro  input 
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axes  and  include  multiple  rates  in  both  the  hi  and  lo  rate  range. 
Rotations  are  also  performed  about  other  axis  to  determine  axis 
misalignments.  These  data  and  previous  data  are  then  written 
into  the  module  PROM. 

Burn-In  Program 

The  Burn-In  stage  of  the  manufacturing  flow  is  unique  in  that 
modules  are  operated  as  a system  rather  than  as  independent 
modules.  Several  factors  lead  to  this  as  the  most  desirable 
implementation.  Operation  as  a System  during  burn-in  maximizes 
operation  of  the  modules  at  minimum  support  equipment  expense. 
Moreover,  the  System  level  redundancy  management  and  self-test 
provides  a real  time  monitor  of  functional  and  inertial  per- 
formance. Most  significantly  however,  is  that  when  operated  as 
a module  in  the  navigation  mode,  they  can  easily  be  tested  across 
a vibration  environment. 

During  Burn-In  the  Burn-In  Monitor  (BIM)  tracks  hardware, 
initiates  background  tests  in  the  operational  units,  executes 
I/O  and  monitors  test  points  while  undergoing  temperature  cyclina 
and  vibration. 

Acceptance  Test  Procedure  (ATP)  1A,  IB 

ATP  1A  and  IB  parallels  tests  performed  in  MTP  1A  and  IB;  how- 

ever'  is  an  end  to  end"  test  and  must  be  entered  at  the  start 
and  completed  without  failure. 

7.1.3  Test  Equipment 

The  proposed  test  equipment  is  an  extension  of  Litton 1 s LSS-370 
family  of  automatic  test  equipment.  It  is  derived  from  almost 
a decade  of  automatic  and  semi-automatic  test  equipment.  Current 
applications  include: 

CAINS  IMU  Test  Station 

LN-31  INU  Test  Station  with  multiplex  capability 
CGATS  Platform  Test  Station, 

Figure  7-2  shows  the  LN-31  INU  multiplex  station.  Fundamental  to 
the  LSS  370  concept  is  a powerful  real  time  operating  system 
which  controls  all  user  tasks,  disc  management  memory  allotment 
and  task  queing . The  system  provides  effective  CPU  management 
and  allows  concurrent  multiple  users,  or  partitions. 
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Figure  7-2.  LN-31  INU  Multiplex  Station 
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Load  Station 

The  Load  Station  is  configured  as  shown  in  figure  7-3  with  three 
Partitions,  Rack  O controls  all  three  partitions.  It  houses 
the  computer  complex: 

PDP-11- 3 5 
Disc 

Extended  Core  Memory 
Tape  Loader 

The  operating  system  controls  and  communicates  with  each  partition 
a bus  system.  Also  housed  in  Rack  O are  the  common  commer  — 
equipment  with  low  utilization,  namely  the  frequency  mea- 
surement equipment.  This  is  used  to  measure  the  instrument  loop 
frequency  characteristics. 

Each  partition  of  Racks  1 and  2 behaves  identically  and  indepen- 
dently of  the  other  partitions  though  they  share  a common  master 
computer.  This  multiplex  mode  is  currently  in  operation  in  the 
LN31  INU  Test  Station.  Both  the  programmable  digital  multimeter 
( DMM)  and  scope  have  access  to  300  signal  channels  via  the 
scanner;  signal  routing  and  measurement  are  all  under  software 
control . 

The  operator  interface  is  through  the  CRT,  Keyboard  and  Printer. 
The  CRT  displays  time,  test  mode,  test  number,  unit  under  test 
( UUT ) status  and  current  test  results.  In  the  lower  1/3  of  the 
CRT,  operator  messages  are  displayed.  Messages  are  only  displayed 
when  operator  action  is  required  and  a keyboard  response  is 
needed.  The  keyboard  allows  the  operator  to  select,  initiate 
or  terminate  a test  as  well  as  input  data  and  respond  to  messages. 
A printer  provides  hard  copy  of  all  test  results  and  requested 
operator  transactions. 

In  addition  to  the  Scan  Control  and  the  Scanner,  Rack  2 contains 
the  Rack  Control  Unit  (RCU)  and  System  Interface  Unit  (SIU) . 

The  RCU  furnishes  the  digital  interface  with  the  computer  bus 
system,  formatting  all  inputs  and  deciphering  outputs.  The  RCU 
interfaces  the  commercial  equipment  including  the  CRT,  DMM,  Key- 
board, Printer,  etc.  as  well  as  the  unique  UUT  interface  elec- 
tronics. The  latter  are  housed  in  the  SIU.  Typical  of  these 
devices  are  the  hi  and  lo  speed  data  bus  receiver  and  drivers, 
discrete  monitors,  loads,  time  interval  monitors  and  input  test 
stimulus.  The  SIU  uniquely  identifies  a configuration  of  the 
LSS-370  for  a given  application. 
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Figure  7~3.  Load  Station 
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Not  shown  in  figure  7-3  are  the  granite  block,  work  surface  and 
module  indexing  fixture  provided  for  each  partition.  The  work 
surface  provides  an  inertially  stable  and  level  reference  for 
orienting  the  module  in  its  fixture  into  all  six  test  positions. 

The  Rate  Calibration  Station  (RCS)  has  been  configured  for  pro- 
duction testing  and  therefore  to  support  factory  troubleshooting, 
a single  axis  rate  table  has  been  provided  in  the  third  partition 
of  the  Load  Station. 

Rate  Calibration  Station 

The  RCS  is  shown  in  figure  7—4.  Rack  0 and  1 are  essentially 
identical  to  those  of  the  Load  Station  with  the  exception  of  the 
frequency  measuring  equipment.  It  is  not  required  here  and  is 
deleted.  Rack  2 has  a unique  SIU  designed  to  interface  with  the 
8 units  under  test.  This  interface  is  restricted  to  communica- 
tion via  the  low  frequency  serial  bus  for  transmittal  of  data  and 
commands.  The  RCU  of  Rack  2 now  houses  a new  complement  of  inter- 
faces to  service  the  multi-module  SIU,  Data,  Display  and  Record- 
ing devices,  and  two  rate  tables.  Rack  3 contains  auxiliary 
printers  and  displays  to  support  test  monitoring  without  inter- 
facing with  test  control  displays  of  Rack  1. 

High  angular  rate  testing  of  large  packages  requires  specialized 
rate  tables.  The  proposed  Rate  Table,  shown  in  figure  7-5  has 
high  angular  acceleration,  and  provides  the  accuracy  and  pre- 
cision control  required  for  rate  testing.  Currently  Litton  is 
using  a version  of  the  multi-gimbal  table  shown  here.  The  table 
is  capable  of  rates  to  1000°/sec  and  test  packages  to  34  kg 
( 75  pounds) . 

Inertial  Navigation  Modules  will  be  calibrated  individually 
rather  than  in  a 4-module  system.  Because  of  the  high  cost  of 
the  Rate  Table,  however,  up  to  4 modules  will  be  calibrated  in 
parallel.  The  orientation  of  the  4 INM's  must  be  identical 
rather  than  rotated  90°  from  each  other  as  in  an  aircraft 
installation.  In  order  to  fit  4 modules  on  the  Rate  Table,  they 
should  be  mounted  side-by-side.  Therefore,  the  instrument  block 
engagement  should  be  at  the  rear,  connector  end  of  the  unit 
rather  than  at  the  side  as  indicated  in  paragraph  6.2.10. 

Burn-In  Monitor  (BIM) 

The  BIM  supports  the  burn-in  of  two  systems,  8 modules.  The  BIM 
station  is  configured  similar  to  Racks  0,  1,  2,  3 and  4 of  the 
Calibration  Rate  Station  since  both  stations  handle  8 units  on 
a limited  access  basis.  The  BIM  interfaces  with  an  environmental 
chamber  housing  the  systems  under  test.  Fixtures  within  the 
chamber  orient  the  systems  and  provide  wrap-around  of  signals  to 
allow  self  monitoring  of  input  and  output  circuitry. 
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Figure  7-4.  Rate  Calibration  Station 
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301  ALPHA  DRIVE,  PITTSBURGH,  PA.  15238  • TEL.  412-782-3516  • TWX  7KM64-2082 


MODE!.  555  7KRFF-A.XIS  AUTOMATIC  TEST  STAND 

GENERAL 

Th«  Modal  555  Thrae-Axls  Automatic  Test  Stand  is  a multi-axis  fixture  designed  to  test  inertial  guidance  and  control  systems. 
It  is  fitted  with  digital  position  transducer!  that  allow  the  test  stand  to  be  operated  by  a variety  of  automatic  control 
devices  such  as  a digital  computer  or  tape  reader. 


Motion  about  all  axes  it  produced  by  direct  drive  DC  torque  motors.  Rate  control  to  1,000  degrees  per  second  about  these  axes 
is  achieved  by  means  of  0.1%  ripple  direct  mounted  DC  tachometers.  Three  nodes  of  automatic  digital  positioning  and  readout 
are  available  at  13  arc  second  accuracy  and  9. 0005  degree  resolution  up  to  1,000  degrees  per  second,  at  0.0001  degree  reso- 
lution to200  degrees  per  second,  or  a dual  0 . 001  and  0 . 0001  degree  resolution  system  providing  both  1,000  and  200  degrees  per 
second  maximum  speed  selection.  A Scorsby  motion  aenerator  is  also  provided. 

The  mechanical  structure  of  the  test  stand  is  in  the  azimuth , roll , pitch  axis  configuration.  Since  sliprings  are  provided  for 
both  stand  components  and  the  unit  under  test  (UVT)  signal  and  power  connections,  continuous  rotation  capability  is  provided. 


SPECIFICATIONS 
Servo  Components 

Azimuth  — 

Roll  

Pitch  

All  Axes  

Axis  Inertia,  Torque  and  Accelaration 

Inertia  (alug-faet  squared}  

Stall  Torque  ----  (ft-lbs!  

Stall  Acceleration  (radians  per  second  squared) 

Orthogonality  of  Axes  — 

Bearing  Wobble  ........ — . — ..... 

Intersection  of  Axes  ...... — 

Three  Point  Mounting 

Range  

Resolution  — ...... — 

Trunnion  Shaft  Deflection  

Test  Package 

Size  — 

Weight  


22  ft-lb  torque  motor 
Two  11  ft-lb  torque  motors 
7 ft-lb  torque  motor 

0.11  tachometer,  720-pole  Inductosyn  aid  2-pole  resolver 

Roll  Pitch 

-5 

20  20  6 

C.2  0.S  — ..... O.g 

3 arc  seconds 
2 arc  seconds 

within  a sphere  not  exceeding  1.0  nun  in  diameter 

? degrees 

11  arc  second 

Less  than  0.5  arc  second 

l 4-inchee  by  12-inches  oy  20-inches 
75  pounds 


ELECTRICAL  SPECIFICATIONS 

Sliprings  — 

Resistance  Variation  


100  lines  rated  at  3 amps,  250  volts 
10  milliohms 


CKC 


coapoasTio 


D-150 


Figure  7-5. 


Three 


Axis  Automatic 


Test  Stand 
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MODES  OF  OPERATION /SPEC I FICATIONS 


Position  Mods 
Range 


Maximum  Readout  Speed 

High  Resolution 

High  freed 

Dual  1 

*00  degrees 
per  second 

1.000  degrees 
per  second 

200  degrees 
per  second 

1,000  degrees 
par  second 

Readout  Range 

AOOO.OOOO  to 
B359 .9999  degrees 

AOOO.OOOO  to 

B 359 .9995  degress 

AOOO.OOOO  to 
B359.9999  degrees 

AOOO.OOO  to 

B359 .999  dagrees 

Accuracy 
Stability 
Cont  rol 
bocal 

Re mots 


-0 . S arc  second 

Front  panel  7-.decade  thumbwheel  switch  plus  Enter  Ci 

pushbutton  Cor  each  avis 

As  note  digital  input  per  Report  TR-2034 


Rate  Mode 
Ranges  — 
Resolution 
Accuracy 

Control 

Local 

Remote 


XI,  X10.  X100,  X1000  degrees  per  second 
0,21  of  full  scele  on  eech  renge 

0.1%  or  0.0001  degree  per  second  whichever  is  greeter  averaged 
over  10-degree  intervals  or  larger 

Trent  panel  4-decade  thumbwheel  switch  plus  Enter  Cowand 

pushbutton  for  each  axis 

Remote  digital  input  per  Report  TR-2034 


Scoxeby  Hods 

Sine  Kave  Motion  — 

Thai*  Shift  

Amplitude  Control  * * 

Frequency  Rango  Adjustment 
Amplitude  Range  Control  with 

a 10-Turn  Potentiometer  

Accuracy  of  Motion  — 

Frequency  Range  

Angle  Lncoding  System 
Transducer 

Fine  — — - — - — • 

Coarse  


Applied  to  all  three  axes  at  a selected  frequency 
Adjustable  between  axes 
Provided  independently  for  each  axis 
10/1 

0.1  degree  to  10  degrees 

-0.1  degree  from  a perfect  elne  wave 

10  cycles  per  minute  to  1 cycle  per  minute 


720-pole , *2  arc  second  Inductoeyn 
1-speed  resolver 


Absolute  Angle  Encoding  System 

Rate  Range  (0  to  1,000  degrees  per  second) 

a)  Accuracy  and  Stability  — arc  second 

b)  Quantisation  High  Resolution  System  - 0.14  arc  second 

High  Speed  System l.S  arc  second 

Dual  System  — 0.2C  and  3.4  arc  second 

c)  Velocity  Error  0.2  arc  second  per  radian  per  second 

(When  sampled  at  aubmultiples  of  reference  frequency) 

d)  Output  Display  — — High  Resolution  System  - 0.0001  degree  to  350.090*  degrees 

absolute  angle 

High  Speed  Syetem  0.0005  degree  to  359.9095  degreea 

absolute  angle 

Dual  System — 0 .0001  or  0 . 001  degree  to  359.9990 

or  359.999  degrees  absolute  angle 

a)  Position  Pulse  Outputs  (Available  up  to  1,000  degrees  per  second) 

Pulse  width  1 u»*c 

Intervals  1 -degree  intervals 

Accuracy  — *0.5  arc  second,  ♦O,  -0.4  millisecond 

f)  Digital  Output  Available  for  transfer  to  a digital  computer.  Outputs  are 

transferred  to  a data  buss  on  receipt  of  an  address  and  f rests 
comund  per  Report  TR-20  34. 
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7 . 2 G-6  Gyro  Test 

7.2.1  G-6  Process  Flow 

A projected  G-6  gyro  process  flow  is  shown  in  figure  7-6.  This 
process  flow  is  then  used  to  determine  projected  factory  test 
equipment  requirements.  The  G-6  gyro  design  is  very  similar  to 
the  Litton  G-1200.  Present  production  test  equipment  was  used  as 
the  basis  for  this  description,  with  redesigns  and  modifications 
as  required  to  meet  the  needs  of  the  G-6. 

7.2.2  G-6  Test  Stations 


a . G-6  Final  Test  Station 
List  of  Tests 

• Measure  pickoff  parameters  (In,  P O SF,  P O Offset, 
etc . ) 

• Measure  torquer  parameters  (SF,  axis  align) 

• Measure  rotor  and  flexure  parameters  (G  and  Non-G 
sensitive,  drift  and  repeatability,  random  drift, 
resonant  frequency  etc.) 

• Measure  motor  parameters  (watts  start/run,  milli- 
watts with  torquer-bearing  quality,  run-up  time, 
etc . ) 

• Rapid  reaction  (if  any). 

• Time  constant,  etc. 

• Possibly  a limited  rate  table  test  capability. 
Description 

Uses  a computer  data  acquisition  system  (standard  module) , 
and  automatic  table  to  collect  and  reduce  data.  All 
excitations  are  under  computer  control.  KSR  33  keyboard 
and  printer  provide  the  final  data  printout,  and  opera- 
tor control.  Temporary  data,  operator  instructions, 

UUT  status  and  test  station  condition  are  displayed  on 
a CRT. 

b.  Flexure  Frequency  Station 
List  of  Tests 


• Test  for  the  value  of  the  natural  resonant  frequency 
of  the  G-6  rotor  flexure. 
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Description 

Contains  vibration  exciter  and  photonic  displacement 
sensor  to  create  a closed  loop  system  with  the  flexure. 
Frequency  counter  readout  and  functional  electronics 
are  included. 

Pickoff  Adjustment  Station 


List  of  Tests 


• Takes  data  required  to  determine  dimensional  and 
magnetic  properties  of  rotor  pickoff  surfaces. 

• Measures  pickoff  assembly  parameters. 

• Provides  test  verification  capability  after  lapping. 

Description 

Uses  master  rotor  and  master  pickoff  elements  (per- 
manently mounted  to  fixtures) . Provides  a plotter  out- 
put to  chart  the  rotor  characteristics.  Includes  PAVM 
and  PO  excitation  electronics.  Lapping  facilities  must 
be  provided  to  augment  this  station. 

Pretest  Station 


List  of  Tests 


• Cover  select. 

• Component  select. 

• All  ATP  tests. 

Description 

Contains  a full  set  of  electronics  to  spin,  capture  and 
temp  control  (if  required)  the  gyro.  Measurement 
capabilities  include:  P O parameters,  torquer  param- 

eters, spin  and  motor  parameters,  temperature  sensitivity 
parameters  and  are  provided  through  use  of  a data  acqui- 
sition system  (standard  module)  and  computer.  No  shake 
capability  is  included.  Vacuum  backfill  capabilities 
are  included.  The  station  will  operate  semi-automatical ly . 
The  CRT  will  display  manufacturing  test  procedures  for 
manual  operations.  Analog  strip  chart  recording  (or 
plotter)  can  be  provided  as  augmenting  data. 
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Evacuation  and  Fill  Station 


List  of  Tests 

• Provide  "bakeout" . 

• Purge. 

• Final  backfill. 

• Seal . 

• Leak  check. 

Description 

This  station  is  similar  to  the  G-1200  evacuation  and 
fill  station  in  system  capabilities  but  different  m 
design. 

Static  Rotor  Balance  Station 
List  of  Tests 

• Collect  data  to  determine  static  values  of  radial, 
mass,  etc. , rotor  unbalance. 

• Determine  equivalent  dynamic  values. 

• Reduce  data  and  determine  position  and  amounts  of 
material  that  must  be  removed  to  meet  rotor  balance 
specifications . 

Description 

This  station  contains  a computer  or  calculator  to  col- 
lect and  reduce  data.  It  controls  the  test  for  con- 
sistency, provides  printout  of  how  much  material  to 
remove,  where,  and  the  final  static  parameter  values. 
Equivalent  dynamic  values  are  also  printed.  Modules 
include  the  data  acquisition  system  (standard  panel) , 
temperature  control  (fixture),  test  cube  or  auto  table, 
loop  closure  electronics  and  augmenting  functional 
electronics . 

Dynamic  Balance  Station 

List  of  Tests 

• Adjust  radial  unbalance  of  motor. 

Description 

A Schenk  dynamic  balance  machine  is  used  for  measurement 
and  verification  after  adjustment.  The  station  also  con 
tains  a spin  supply,  a mounting  fixture,  and  a control 
panel - 
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h.  Motor  Test  and  Run-In  Station 


List  of  Tests 

• 100  hour  run-in  of  18  gyro's  simultaneously. 

• Data  collection  of  milliwatt  meter  data  for  bearing 
evaluation  throughout  run-in. 

• Temperature  monitor  throughout  run-in. 

• Self  logging  of  elapsed  time  on  each  gyro. 

Description 

This  station  uses  a minicomputer  or  microprocessor  as  a 
test  controller  and  data  organizer.  A high  speed  data 
acquisition  system  (proposed  throughout  this  gear  and 
is  a standard  module)  is  used  to  scan  all  18  gyro  posi- 
tions for  millivolts,  temperature,  and  elapsed  time. 
This  spin  supply  is  a square  wave  with  individually 
controllable  output  stages  (18).  An  historical  window 
of  data  (e.g.,  30  minutes)  is  stored  in  case  of  power 
failure,  or  in  the  event  a gyro  is  "seen"  as  bad.  All 
data  available  can  be  dumped  on  a KSR  33  (thermal 
printer  with  keyboard) . An  xy  plotter  may  be  included 
to  yield  the  effect  of  a stripchart  recorder  output  for 
the  last  hour  of  each  gyro  run-in. 

i • Resistance  and  Continuity 


List  of  Tests 

• Resistance  test  of  all  circuits. 

• Hi-pot  insulation  resistance  tests. 

• Intercircuit  short  test. 

Description 

This  station  is  similar  to  the  G-1200  Resistance  and 
Continuity  station. 

7 . 3 A-1000  Accelerometer  Test 

The  A-1000  accelerometer  is  a production  design.  The  redundant 
strapdown  INS  accelerometers  will  use  the  test  procedures  and 
equipment  currently  in  use  with  minor  modifications.  Descrip- 

are  not  supplied  as  part  of  this  study  since  the  technology 
is  not  new. 
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VIII.  COST  ANALYSIS 

8.1  Baseline  Cost  Estimate 

Table  8-1  is  an  itemized  breakdown  of  the  projected  cost  of  the 
redundant  strapdown  INS  as  described  in  Sections  V and  VI,  and 
tested  with  Factory  Test  Equipment  similar  to  that  shown  in 
Section  VII. 

TABLE  8-1.  REDUNDANT  STRAPDOWN  INS  PREDICTED 
AVERAGE  COST,  200  SYSTEMS 


ELEMENT  COST  (1976  $) 

GYRO  4<331 

ACCELEROMETERS  (2)  3,751 

COMPUTER/MEMORY  3,697 

BLOCK/REBALANCE  ELECT.  2,862 

MODE/IMM  I/O  1,252 

INTERNAL/EXTERNAL  I/O  2,246 

POWER  SUPPLY/INTERRUPT  3,864 

CHASSIS  2,481 


TOTAL,  PER  CHANNEL  24,484 


TOTAL  SYSTEM  97,936 

SYSTEM  LESS  MOUNT  95,560 


"Cost"  is  defined  as  cost  to  an  airline  based  on  1976  dollars. 
Therefore,  the  estimate  of  table  8-1  includes  not  only  the  average 
cost  to  build  200  INS  (800  channels),  but  also  an  estimate  of 
amortized  development,  production  tooling,  and  test  equipment 
costs.  The  amortization  schedule  also  includes  delivery  of 
redundant  strapdown  INS  equipment  to  other  users  beyond  the 
requirements  of  short-haul  VTOL.  The  total  build  of  systems  is 
assumed  to  be  similar  to  the  quantity  of  first-generation,  com- 
mercial inertial  systems,  LTN— 51,  built  by  Litton  to  date. 
Approximately  14%  of  the  net  cost  is  due  to  this  amortization. 


347 


403314 


Cost  items  generally  incurred  by  airlines  but  not  included  in  this 
total  cost  estimate  are  warranty,  training  and  maintenance.  These 
are  somewhat  variable,  depending  upon  customer  requirements. 

8.2  Basis  of  Estimate 

The  cost  estimate  was  prepared  from  an  estimated  bill  of  material 
of  electronic  components  and  the  preliminary  chassis  desiqn  shown 
in  paragraph  6.1.10.  Component  costs  were  then  estimated  from  the 
current  catalog  prices  of  these  or  similar  items.  Some  limited 
extrapolation  of  prices  was  needed  based  on  cost  trends  (not 
including  inflation)  especially  in  the  area  of  digital  circuits. 
Material  costs  are  then  factored  to  include  line-flow,  attrition 
and  common  stores  items. 

Allocation  of  components  to  printed  circuit  cards  was  made,  from 
which  assembly  and  test  hours  were  derived.  Cost  of  assembly 
and  test  labor  also  included  factory  allocables  such  as  manu- 
facturing engineering,  production  control,  quality  assurance, 
test  equipment  maintenance  and  sustaining  design  engineering. 

The  chassis  mount  costs  were  spread  among  the  various  system 
elements,  based  on  the  ratio  of  that  element's  cost  to  total 
channel  cost.  System  cost  excluding  the  chassis  mount  is  also 
shown  in  table  8-1.  Some  form  of  installation  provisions  would 
probably  be  supplied  by  the  airframe  designer  in  many  applications. 

An  estimate  was  then  made  of  the  total  developmental  cost  of  the 
redundant  strapdown  INS  including  productionizing  the  design, 
environmental  and  EMI  testing,  handbooks,  software,  etc.  Cost 
of  design  or  modification  of  test  equipment  and  production  tool- 
ing was  estimated  as  well  as  the  procurement  or  build  of  a suffi- 
cient quantity  of  items  needed  to  support  the  production  rate. 

The  total  sum  of  development,  tooling  and  test  equipment  was 
then  amortized  over  an  assumed  number  of  systems,  with  the 
amortized  amount  then  added  to  unit  production  cost.  The 
amortized  amount  added  to  each  system  element  was  based  on  the 
ratio  of  that  element's  build  cost  to  total  channel  build  cost. 
Final  element  costs  include  a factor  for  profit. 

8 . 3 Cost  Reduction  Prospects 

One  area  of  potential  system  cost  reduction  is  in  the  use  of  less 
accurate  gyros.  Use  of  the  Litton  G-7  gyro  instead  of  the  G-6 
could  reduce  system  cost  by  nearly  $3,000.  A more  sophisticated 
filter  combining  radio  and  inertial  data  would  be  needed,  however, 
as  described  in  Section  5.2  and  paragraph  4.5.2. 

Further  cost  reduction  may  be  obtainable  from  the  advancements 
of  digital  technology.  No  attempt  will  be  made  to  quantify  such 
a reduction,  however. 
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DEVELOPMENT  SPECIFICATION 
REDUNDANT  STRAPDOWN  INERTIAL  NAVIGATION  UNIT 


1 . SCOPE 

1 . 1 Identification 

This  specification  establishes  the  design  requirements  for 
a low-cost,  twice  fail-operational  redundant  strapdown  inertial 
navigation  unit,  using  two-degree-of-freedom,  tuned-gimbal 
gyroscopes . 

1 . 2 Introduction 

Improved  integration  of  the  various  aircraft  avionics  func- 
tions can  lead  to  significant  aircraft  cost  reductions.  Sharing 
of  sensors  between  navigation  and  flight  control  functions,  and 
sharing  of  computers  by  navigation,  flight  control  and  air  data 
functions,  tends  to  produce  a low  system  cost  with  improved  capa- 
bility. Modern  fly-by-wire  aircraft  using  such  a system  require 
extremely  high  reliability  to  achieve  sufficient  flight  safety. 

The  specified  redundant  strapdown  INS  achieves  the  required  reli- 
ability. It  is  initially  directed  toward  short  haul  VTOL  aircraft 
but  shall  be  designed  to  be  applicable  to  the  full  range  of  civil 
and  general  aviation.  Low  cost  is  a firm  design  objective. 

2.  APPLICABLE  DOCUMENTS 

2.1  The  following  documents,  of  the  issue  in  effect  on  the  date 
of  invitation  for  bids  or  request  for  proposal,  form  a part  of 
this  exhibit  to  the  extent  specified  herein. 

SPECIFICATIONS  TITLE 

ARINC  404  Specification,  Air  Transport  Equipment 

Cases  and  Racking 
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SPECIFICATIONS  lilj£: 

ARINC  413  Report,  Guidance  for  Aircraft  Electrical 

Power  Utilization  and  Transient 
Protection 

ARINC  414  Project  Paper,  General  Guidance  for 

Equipment  and  Installation  Designers 

ARINC  571  Characteristic,  Inertial  Sensor  System 

(ISS) 

ARINC  575  Characteristic,  Mark  3 Sub-Sonic  Air 

Data  System  (Digital)  DADS 

RTCA  Paper  Environmental  Test  Procedures,  Airborne 

120-61/DO-108  Electronic  Equipment 

3.  REQUIREMENTS 

3.1  Item  Definition 

The  redundant  strapdown  inertial  navigation  unit,  hereinafter 
referred  to  as  INUrS,  shall  provide  multiply  redundant  sensing  of 
inertial  quantities  and  redundant  output  of  aircraft  states  (angu- 
lar rates,  linear  accelerations,  attitude,  heading,  velocities, 
position  coordinates)  to  other  avionics.  Essentially,  inertial 
sensing  devices,  gyros  and  accelerometers,  shall  be  rigidly 
mounted  to  the  airframe  (strapped  down) , without  intervening  gim- 
bals. The  INUrs  shall  be  capable  of  withstanding  any  combination 
of  two  failures  without  degradation  of  system  performance.  It 
shall  also  be  capable  of  accepting  position  and  velocity  updates 
from  external  avionics. 

3.1.1  System  Diagrams 

The  complete  INUrS  shall  consist  of  four  identical  and  inter- 
changeable channels,  as  shown  in  the  system  block  diagram,  fig- 
ure A-l.  Each  channel,  designated  an  inertial  navigation  module 
(INM),  consists  of  the  following  elements. 
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I MM 
NO.  1 


CHANNEL  No.  1 


IMM 

NO.  2 


CHANNEL  No.  2 


IMM 

NO  3 


CHANNEL  No.  3 


IMM 
NO.  4 


CHANNEL  No.  4 


HE} 


COMPUTER  NO.  1 


T 


INTER  - 
COMP 
I/O  NO.  1 


COMPUTER  NO.  2 


INTER- 
COMP 
I/O  NO.  2 


COMPUTER  NO.  3 


INTER  - 
COMP 
I/O  NO.  3 


COMPUTER  NO.  4 


INTER  - 
COMP 

I/O  NO.  4 


EXTERNAL 
I/O  NO.  1 


EXTERNAL 
I/O  NO.  3 


EXTERNAL 
I/O  NO.  4 


Figure  A-l.  Redundant  Strapdown  INS 
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a.  An  Inertial  Measurement  Module  ( IMM)  with  one  two-degree- 
of- freedom  tuned  gimbal  gyroscope  and  two  axes  of  accel- 
eration measurement  with  associated  electronics  to  pro- 
vide digital  outputs. 

b.  A general  purpose  digital  computer  including  low  cost, 
semiconductor  memory. 

c.  Digital  I/O  for  two-way  communication  with  external 
avionics . 

d.  Digital  I/O  for  read-capability  of  other  INM's. 

e.  Power  supplies,  clock  generators,  and  other  support 
electronics  needed  for  proper  INM  operation. 

The  gyro  and  accelerometers  of  each  INM  shall  be  skewed  rela- 
tive to  INM  axes.  When  the  4 INM's  are  installed  into  a common 
mount,  rotated  90°  relative  to  one  another,  the  4 gyro  spin  axes 
shall  be  normal  to  four  non-parallel  faces  of  an  octahedron. 

Fail-operational/fail-operational  capability  is  obtained 
since  if  two  complete  channels  fail,  two  channels  remain  and  these 
are  sufficient  to  derive  the  required  three  axes  of  output  data. 
Redundancy  management  shall  be  contained  in  the  software  in  each 
computer  and  in  external  equipment  using  the  INURS  data. 

Software  implementation  in  the  four  computers  shall  be  mech- 
anized as  shown  in  figure  A-2.  Software  functions  shall  be  as 
follows  : 

a.  Read-in  gyro  data,  accelerometer  data,  and  calibration 
constants . 

b.  Compensate  measured  angular  rate  and  acceleration  using 
the  input  calibration  constants  and  known  gyro  charac- 
teristics, and  then  transform  measurements  from  skewed 
axes  to  aircraft  body  axes. 

c.  Solve  parity  equations  which  allow  extraction  of  measure- 
ment errors  from  vehicle  angular  rates  and  linear  accel- 
erations, process  outputs  to  detect  and  isolate  failed 
instruments.  Failure  detection  and  isolation  (FDI) 
results  shall  be  combined  with  self-test  results  to 
determine  instrument  status. 
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d Combine  outputs  of  two  gyros  and  two  pairs  of  acceler- 
ometer outputs  in  a least-squares  solution  in  the  design 
equations  to  derive  three  axes  of  acceleration  and 
angular  velocity,  in  aircraft  coordinates.  The  selection 
logic  of  instruments  shall  be  based  on  use  of  the  local 
channel's  instruments  plus  another  channel's  inputs, 
the  next  cyclic*  channel  number  satisfying  FDI/sel f-test . 

e.  Perform  integration  of  angular  rate  inputs  to  determine 
the  transformation  from  aircraft  coordinates  to  naviga- 
tion coordinates,  and  resolve  accelerometer  outputs 
through  this  transformation. 

f.  Solve  inertial  navigation  equations  to  derive  required 
outputs  and  derive  inertial  rate  of  the  navigation 
coordinate  system  to  rotate  the  aircraft- to-navigation 
coordinate  transformation. 

g.  Perform  additional  functions  such  as  software  executive 
control,  ground  gyrocompassing  alignment,  initialization 
and  update  from  a display  or  external  computer,  sel f-test 
and  cross-fed  output  table  comparisons,  redundancy  manage- 
ment reinitialization,  and  gyro  bias  trimming  based  on 
entered  latitude  and  longitude  and  terminal  errors. 

In  order  to  avoid  time-skew  errors,  the  executives  of  each 
of  the  four  computers  shall  be  driven  by  an  interrupt,  and  the 
four  computer  interrupts  shall  be  synchronized  by  fail-op/ fail-op 
circuitry  contained  within  each  INM. 

The  INU  c shall  be  capable  of  operation  as  a fail-op  naviga- 
tor  with  installation  of  only  three  INMs. 


Cyclic  is  defined  as  the  ordered  sequence  of  channel  numbers, 
e.g.  1,2, 3, 4,1, 2 
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3.1.2  In  ter  face  Definitions 


Output  requirements  are  as  follows: 


CATEGORY 

QUANTITY 

RESOLUTION 

RANGE 

BITS 

CYCLE 

TIME 

Pitch  (Eleva- 
tion ) 

15 

2tt/2 

±tf/2  * 

14 

0.03125 

Attitude 

Roll 

2tt/215 

±7T 

15 

0.03125 

Heading,  true 

2tt/215 

±7T 

15 

0 . 03125 

At ti tude 

Pitch  Rate 

0.05  °/sec 

±4  rad/sec 

14 

Roll  Rate 

0.05  °/sec 

Rate 

±4  rad/sec 

14 

Yaw  Rate 

0.05  °/sec 

+4  rad/sec 

14 

Body ♦♦ 

Longitudinal 
Accel . 

0.003  m/sec^ 

±10  g 

11 

0.03125 

Accel- 

Lateral Accel. 

+10  g 

0.03125 

eration 

Vertical  Accel, 
(body) 

0 

0.003  m/sec 

+10  g 

0.03125 

North  Velocity 

0.03  m/sec 

±1686  m/sec 

3 

0.125 

East  Velocity 

0.03  m/sec 

±1686  m/sec 

16 

0.125 

Naviga- 

tion 

Vertical  Vel . 
(earth ) 

0.03  m/sec 

+1686  m/sec 

16 

0.125 

Outputs 

Latitude 

2tt/219 

+tt/2* 

18 

0.5 

Longi tude 

2tt/219 

±1T 

19 

0.5 

Altitude 

0.3  m 

-305  m to 
18.3  km 

16 

0 . 5 

Other 

Mode/Status 

N/A 

N/A 

16 

0.03125 

*These  outputs  are  generally  scaled  at  ±n. 

♦♦Installation  is  assumed  to  be  at  the  aircraft  center  of 
gravity  so  lever-arm  accelerations  are  not  included. 


These  outputs  shall  be  provided  separately  from  each  INM  on 
an  ARINC  575  format  serial  data  channel.  An  additional  discrete 
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relay  closure  shall  be  provided  from  each  INM  to  indicate  normal 
TNM  operation,  opening  during  a failed  or  off  condition. 

Three  ARINC  575  receivers  shall  be  provided  in  each  INM. 

One  receiver  shall  be  used  to  input  aircraft  barometric  altitude 
with  resolution,  range,  and  cycle  time  TBD.  The  second  receiver 
shall  be  used  to  input  a system  mode  word,  and  position  and 
velocity  updates  with  resolution,  range,  and  cycle  time  TBD. 

The  third  receiver  shall  be  for  growth  purposes. 

A discrete  input  shall  be  provided  to  each  INM  by  means  of 
external  jumper  wires  to  identify  the  channel  number  to  software 
for  use  in  skewed-axis  to  aircraft-axis  transformations  and 
parity  equations.  Two  additional  jumper  wires  shall  be  monitored 
to  determine  +90°  installation  from  the  nominal  orientation 
described  in  paragraph  3. 2. 2.1. 

3.1.3  Inter-Channel  Interface 

The  following  variables  shall  be  received  by  each  channel 
from  the  other  three  channels: 

Compensated  velocity  increments  (3) 

Compensated  angular  increments  (3) 

Attitude  matrix,  e.g.,  quaternions  (4) 

Vehicle  velocity  components  (3) 

Navigation  direction  cosines  (6) 

Inertial  altitude 

Accumulated  velocity  updates  (2) 

Accumulated  position  updates  (2) 

Output  table  (15) 

Status 

Some  variables  require  transmission  of  more  than  one  computer 
word  to  obtain  sufficient  precision . Transmission  of  all  37  vari- 
ables shall  be  completed  in  1/128  second.  Transmission  of  the 
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first  six  variables  shall  be  completed  within  50  microseconds 
after  initiation  of  transmission.  Scaling  and  resolution  are 
TBD. 

3.1.4  Major  Components 

The  INUrs  shall  consist  of  four  interchangeable  line  replace- 
able INM  and  one  chassis/mount.  The  chassis/mount  shall  contain 
provisions  as  follows: 

a.  A shell  to  house  the  four  INMs. 

b.  A central  alignment  block  to  register  the  INM  gyros 
and  accelerometers  to  each  other. 

c.  Attachment  for  four  aircraft  cable  connectors,  one  for 
each  INM. 

d.  A latching  mechanism  to  hold  each  INM  into  the  chassis 
mount,  provide  connector  engagement  between  the  INM 
connector  and  the  aircraft  connector,  and  lock  the  INM 
instrument  block  to  the  central  alignment  block. 

e.  Attachment  for  aircraft  cooling  methods. 

f.  A plenum  for  even  distribution  of  cooling  air  through 
the  4 INM's. 

g.  Provisions  for  bolting  the  INURg  to  the  aircraft  and  pro- 
viding for  boresight  alignment  of  the  central  alignment 
block  to  the  aircraft  axes. 

3 . 2 Characteristics 

3.2.1  Performance 

3. 2. 1.1  Modes  of  Operation 

The  basic  operating  modes  of  the  INU  are  as  follows: 

Ro 

OFF  All  power  is  removed  from  the  system. 

ALIGN  Automatic  sequencing  through  the  various  steps  needed 
for  alignment  shall  be  provided.  The  align  mode  is 
initiated  only  on  the  ground.  Automatic  transfer  to 
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ALIGN  the  navigate  mode  shall  occur  if  aircraft  motion 

(cont)  is  detected  via  the  INS  accelerometers. 

NAV  All  outputs  shall  be  provided  to  full  accuracy  in 

this  mode. 


ATTITUDE  Consideration  shall  be  given  to  use  of  a pendulous 
attitude  mode  in  flight  during  certain  failure  con- 
ditions if  the  end  reliability  of  attitude  and 
attitude  rate  outputs  can  be  improved. 


These  modes  are  mutually  exclusive  and,  with  the  exception 
of  ATTITUDE,  are  selected  from  an  operator's  panel  external  to  the 
INUrS-  The  ATTITUDE  mode,  if  provided,  shall  be  selected  by 
redundancy  management  software  in  the  event  of  a third  channel 
failure. 

Other  software-controlled  operating  modes  shall  be  provided. 
These  are: 

UPDATE  Accept  position  and  velocity  coordinate  errors  (4) 
and  correct  INURS  outputs.  Provide  growth  capabil- 
ity for  tilt,  heading,  and  gyro  bias  updates. 
Updates  will  be  made  asynchronously,  with  a mini- 
mum time  duration  of  1 second  between  updates. 


RECON-  Based  on  results  of  FDI  and  self-test,  change 

FIGURE  selection  of  instrument  channel  number  being  used 

in  design  equation  solution.  Reuse  of  a pre- 
viously failed  channel  shall  be  provided  if  it 
again  satisfies  FDI  thresholds. 


REIN-  A computer  shall  reinitialize  its  attitude  trans- 

ITIALIZE  formation,  velocity,  and  position  calculations  to 
another  channel's  values  following  reuse  of  a 
previously  failed  channel,  including  one  that  was 
removed  and  replaced  during  maintenance.  In  addi- 
tion, consideration  shall  be  given  to  reinitializa- 
tion under  the  following  conditions: 


a.  Following  any  channel  reconfiguration  activated 
by  FDI  provisions. 

b.  Following  detection  of  a large  error  in  soft- 
ware output  tables,  which  may  have  been  caused 
by  a computer  transient. 
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3. 2. 1.2  Accuracy 


The  INUrs  shall  have 
Attitude  rate 
Body  acceleration 
Atti tude 
Heading 


Velocity  (no 
updates) 


Position 
(no  updates) 


the  following  output  accuracy: 

0.05°/sec,  rms , per  axis 
2 

0.003  m/sec  , rms,  per  axis 
0.1°,  rms,  per  axis 
0.2°,  rms,  VTOL  flight  profile 
TBD° , rms,  CTOL*  flight  profile 
3 m/sec/axis,  la,  VTOL  flight  profile 
TBD  ft/sec/axis,  lo,  CTOL  flight  profile 
7.4  km/HR,  CEP,  VTOL  flight  profile 
TBD  NM/HR,  CEP,  CTOL  flight  profile 


This  accuracy  shall  apply  with  either  0,  1 or  2 hardware 
failures,  through  the  operational  environment  described.  It  is 
assumed  that  aircraft  installation  errors  are  not  included,  air- 
craft parking  coordinates  have  been  entered  perfectly,  and  a full 
gyrocompassing  alignment  has  been  completed  at  a latitude  of 
45°  prior  to  first  aircraft  motion. 


3.2.1. 3 Ground  Alignment  Time 

The  redundant  strapdown  INU  shall  complete  its  self-contained 
alignment  in  less  than  10  minutes  from  system  turn-on.  No  external 
inputs  shall  be  required,  with  the  exception  of  aircraft  latitude 
and  longitude  entered  within  two  minutes  after  system  turn-on. 
Aircraft  motion  during  alignment  shall  consist  of  the  model 
described  in  Paragraph  3. 2. 5. 2. 3.  The  alignment  time  required 
applies  for  a starting  ambient  temperature  greater  than  0°C  and 
less  than  50°C  and  for  a latitude  less  than  70°. 

★ 

Conventional  take-off  and  landing  aircraft. 
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3. 2. 1.4  Redundancy  Management 

3. 2. 1.4.1  Redundancy  Management  Logic 

Redundancy  management  logic  shall  consist  of  the  following: 

a.  A computer  shall  always  use  the  instruments  within  its 
own  INM  chassis. 

b.  A computer's  output  calculations  shall  be  based  on  only 
two  channels  of  instrument  data. 

c.  The  second  channel  used  in  a given  calculation  shall  be 
the  next  working  cyclic  channel  number. 

d.  Accelerometer  and  gyro  redundancy  management  shall  be 
independent  of  each  other  except  for  major  failures 
detected  by  self-test. 

e.  Detection  and  isolation  of  a failure  of  one  axis  of  a 
channel  shall  cause  rejection  of  both  axes  of  data, 
except  (a.)  supersedes. 

f.  An  instrument's  outputs  shall  continue  to  be  monitored 
following  its  rejection,  but  not  included  in  output 
calculation,  except  (a.)  supersedes. 

g.  If  a failed  instrument  returns  to  working  condition  as 
determined  by  FDI , it  shall  be  reinstated  into  output 
calculations,  based  on  normal  instrument  selection  logic. 
The  computer  of  the  same  channel  number  of  the  reinstated 
instrument  shall  reinitialize  to  the  state  of  a non— 
failed  channel. 

h.  Logic  shall  be  incorporated  to  detect  and  isolate  two 
simultaneous  failures  within  information  limits  of  a 
4-gyro  skewed  array. 

i.  During  the  condition  of  isolation  ambiguity,  monitoring 
shall  continue.  A status  word  output  shall  indicate 
presence  of  a failure  and  approximate  magnitude. 

j.  Indicated  instrument  failures  shall  be  placed  into  3 
categor ies : 

a.  HARD  - inoperative  (self-test) 

b.  GF3  - nav  and  flight  control  failure 

c.  GF3  ~ nav  failure 
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k.  Instruments  with  category  HARD  failures  shall  never  be 
reused  even  if  failure  condition  disappears. 

l.  Instruments  with  category  GF-j  failures  should  be  used 
following  a third  channel  failure  or  to  resolve  a cate- 
gory GF^  3-gyro  isolation  ambiguity 

3. 2. 1.4. 2 Error  Detection/Switching  Levels*  and  Time 

The  levels  which  shall  be  used  in  the  FDI  mechanism  to 
indicate  failure  of  an  instrument  are  given  in  table  A-I.  An 
instrument  error  and  its  integral  are  shown.  The  threshold  error 
is  the  minimum  detectable  instrument  error.  The  error  integral, 
e.g.,  angle  delta  or  velocity  delta,  may  be  used  to  determine 
the  time  to  detect  large  errors.  FDI  solution  time  shall  be  suf- 
ficiently fast  that  errors  greater  than  these  amounts  do  not 
reach  system  outputs  regardless  of  instrument  error  amplitude. 


TABLE  A-I.  PRELIMINARY  ERROR  DETECTION/ SWITCHING 
LEVELS  PER  INSTRUMENT 


FAILURE  TYPE 

GROUND 

FLIGHT 
NO  TURNS 

FLIGHT  TURNS 

NAV  FAILURE 

Acceleration  Threshold 

0.003  m/ 
sec^ 

0.001  m/ 
2 

sec^ 

TBD 

Velocity  Delta 

1.5  m/sec 

4 m/sec 

TBD 

Angular  Rate  Threshold 

0 . 1 °/hr 

1 “/hr 

TBD 

Angle  Delta 

30  sec 

60  sec 

TBD 

NAV/FLT  CONTROL  FAILURE 

Acceleration  Threshold 

N/A 

0.03  m/ 
sec^ 

0.03  m/sec^ 

Velocity  Delta 

12  m/sec 

12  m/sec 

Angular  Rate  Threshold 

|H 

1 “/sec 

1 °/sec 

Angle  Delta 

■■ 

1° 

1° 

* 

Detection/switching  levels  indicated  in  the  table  are  approximate. 
Further  testing  and/or  analysis  are  needed  to  establish  reason- 
able levels.  Corrective  maintenance  action  will  occur  if  one  or 
more  nav  failures  is  indicated  before  takeoff. 
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3. 2. 1.4. 3 Performance  Transients 

System  error  buildups  following  occurrence  of  a failure,  but 
before  FDI  action,  shall  be  minimized.  Performance  shall  return 
to  normal  following  redundancy  management  actions. 

3. 2. 1.5  Performance/Environment 

A typical  flight  profile  for  the  VTOL  application  consists 

of  : 

a.  System  turn-on  at  20°C,  start  alignment,  passenger 
loading/refueling  in  progress,  aircraft  subject  to 
wind  gusts,  ground  power  applied  to  the  aircraft. 

b.  Engine  turn-on  after  five  minutes. 

c.  System  advanced  to  Navigate  Mode  after  10  minutes,  remove 
ground  power 

d.  Engage  rotors,  perform  vertical  take-off. 

e.  Climb  to  305  m altitude,  turn  left  90°  at  a turn  rate  of 
3°/sec. 

f.  Accelerate  to  103  m/sec  and  cruise  for  6 minutes. 

g.  Turn  left  90°  then  spiral  down  at  turn  rates  of  3°/sec. 
(typical  peak  turn  rate  of  30°/sec). 

h.  Decelerate  and  perform  vertical  descent  to  touchdown. 

i.  Disengage  rotors,  unload/reload  passengers  for 
3.5  minutes. 

j.  Repeat  d thru  h two  additional  times,  then  turn  off 
system  power. 

The  non- VTOL  applications  are  assumed  to  have  the  flight  pro- 
file as  follows: 


| > Same  as  above 

c.  ) 

d.  Take-off,  climb  to  9,000  m altitude,  accelerate  to 
257  m/sec. 
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e.  Turn  left  90°  at  a turn  rate  of  3°/sec. 

f.  Cruise  for  2 hours  with  two  10°  course  changes  at  turn 
rates  of  l°/sec. 

The  required  and  desired  aircraft  operational  performance  limits 


are : 

VTOL 

CIVIL  OR  GENERAL 
AVIATION 

Angular  Rates 

4 rad/sec 

4 rad/sec 

Angular  Acceleration 

50  rad/sec^ 

50  rad/sec^ 

Linear  Accel,  (maneuver) 

±3  g 

±3  g 

Velocity  (max. ) 

154  m/sec 

1029  m/sec 

Altitude 

3048  m 

18,300  m 

Aircraft  tilt  (parked) 

+5° 

±5° 

Range  of  operation 
( 1 a t i t ude ) 

±70° 

Worldwide 

3 . 2 . 1 . 6 Power 

The  aircraft  power  supply  characteristics,  utilization  and 
general  guidance,  are  given  in  ARINC  413.  The  redundant  strap- 
down  INU  shall  be  designed  to  use  115V  AC  single  phase  power,  per 
mil-STD-704,  Category  B.  A separate  input  shall  be  utilized  for 
each  redundant  power  supply. 

Capability  of  operation  from  an  external  battery,  equivalent 
to  Sonotone  P/N  CA— 51N,  shall  be  provided  with  each  redundant 
power  supply.  in  addition,  each  supply  shall  contain  a battery 
charger,  as  required  by  ARINC  561.  The  redundant  strapdown  INS 
shall  also  have  the  capability  of  operating  from  redundant  standby 
computer  DC  buses  for  backup  power,  as  defined  in  ARINC  571,  para- 
graph 2.4. 5.1,  in  lieu  of  the  battery. 

Maximum  average  power  drawn  by  each  INM  during  flight  condi- 
tions shall  be  under  150  watts.  The  chassis/mount  shall  require 
no  power. 
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3. 2. 1 . 7 Cooling 

Cooling  air  having  the  characteristics  of  ARINC  404  may  be 
utilized  if  required.  Maximum  cooling  air  flow  shall  be  14  kg/ 
hour/100  watts.  Cooling  air  attachment  method,  if  other  than  that 
specified  in  ARINC  404,  shall  be  TBD. 

3. 2. 1.8  Operational  Service  Life 

The  redundant  strapdown  INS  shall  be  capable  of  operation  for 
at  least  3,000  hours,  preferably  5,000  hours,  without  additional 
lubrication,  adjustment  or  replacement  of  components  (per  ARINC 
414).  Scheduled  calibrations  required  to  be  performed  during 
Level  2 maintenance,  shall  be  minimized. 

3.2. 1.9  Built-In  Self-Test 

Minimum  self-contained  self-test  features  shall  be  incorporated 
within  each  INM: 

• To  prevent  chain-type  failure  modes  which  could  lead 
to  extensive  equipment  or  aircraft  damage. 

• To  provide  a high  level  of  capability  of  detecting 
failures  of  each  gyro  to  reduce  the  probability  of  a 
failure  occurring  within  the  3-gyro  isolation 
singularities. 

• To  contribute  to  making  the  third  failure  a fail-safe 
condition,  that  is,  to  indicate  to  the  aircraft  flight 
crew  that  a failure  has  occurred. 

• To  provide  information  to  maintenance  personnel  for  use 
in  determining  the  failed  module  for  repair. 

3.2.2  Physical  Characteristics 

3. 2. 2.1  Inertial  Measurement  Skewed  Axis  Geometry 

Figure  A- 3 shows  the  nominal  orientation  of  the  accelerometer 
and  gyro  input  axes,  and  gyro  spin  axes  relative  to  aircraft  axes. 
The  angles  between  axes  shall  be  as  determined  by  the  faces  of 
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Figure  A-3.  Inertial  Measurement  Axis  Geometry  (Nominal) 
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half  of  a regular  octahedron.  The  two  orthogonal  gyro/accelerometer 
input  axes  shall  be  oriented  symmetrically  relative  to  the  outside 
edge  of  the  octahedron. 

Normal  orientation  of  the  octahedron  relative  to  aircraft 
axes  is  shown  in  figure  A-3.  Some  applications  may  require 
installation  into  the  aircraft  with  the  INURS  rotated  ±90°  about 
2 from  the  nominal.  Means  of  computing  the  outputs  in  either 
rotated  installation  shall  be  provided  by  means  of  jumper  wires 
on  the  INM  connectors. 

3.2. 2.2  Dimensions 

The  maximum  INU_C  dimensions  are  shown  in  figure  A-4 . These 
Rb 

dimensions  do  not  include  protrusions  such  as  handles,  latching 
mechanisms,  connectors,  or  boresight  adjustment  provisions.  They 
do  include  the  holding  chassis/mount. 

3 . 2 . 2 . 3 Weight 

The  weight  of  the  INURS  shall  not  exceed  32  kg.  The  weight 
of  each  INM  shall  not  exceed  7 kg. 

3. 2. 2. 4 Alignment  Repeatability 

The  angular  alignment  between  the  instrument  blocks  of 
adjacent  INM's  shall  be  90°  +30  arc  seconds  (3  sigma).  This 
alignment  shall  be  maintained  following  repeated  insertions  of  each 
INM,  and  through  the  environments  specified  in  paragraph  3.2.5. 
Removal  and  replacement  of  one  INM  shall  not  disturb  the  alignment 
of  the  remaining  three. 

The  angular  alignment  between  the  alignment  block  and  air- 
craft axes  shall  be  capable  of  being  boresighted  to,  and  maintain- 
ing through  the  environments  of  paragraph  3.2.5,  an  accuracy  of 
±12  arc  minutes  in  pitch,  roll,  and  yaw. 
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3 . 2 . 2 . 5 Packaging  of  Redundant  Elements 

The  four  INM's  shall  each  be  packaged  into  a separate 
housing.  The  chassis  mount  shall  provide  EMI,  thermal,  and  as 
much  mechanical  shielding  between  INM’s  as  practical  within 
weight  and  size  limitations,  to  reduce  the  probability  of  multi- 
ple INM  failures  due  to  a single  cause.  There  shall  be  no  elec- 
trical interconnection  between  INMs  within  the  confines  of  the 
INUrS  envelope. 

It  is  assumed  that  the  aircraft  designer  will  locate  the  INU^ 
away  from  the  path  of  rotating  machinery  such  as  engines  or  APUs 
which  might  shed  debris  during  certain  failure  modes. 

3.2.3  Reliability 

The  probability  of  failure  of  the  INURg  during  a 0.5  hour 
flight,  assuming  no  failures  are  present  at  takeoff,  shall  be 
less  than  10~^ , including  effects  of  self-contained  FDI  coverage.* 
^ failure  is  said  to  occur  when  undetected  or  unisolated  gyro  or 
accelerometer  errors  exceed  the  navigation  performance  detection 
levels  given  in  table  I of  paragraph  3. 2. 1.4. 2.  Coverage  of  FDI 
capability  external  to  the  INURS  shall  be  assumed  to  be  unity 
for  both  fail-op  levels. 

The  probability  of  failure  of  the  attitude  rate  and  accelera- 
tion outputs  of  the  INURS  during  a 1.0  hour  flight,  assummg^no 
failures  are  present  at  takeoff,  shall  be  less  than  5 x 10  , 

including  effects  of  self-contained  FDI  coverage.  A failure  is 
said  to  occur  when  undetected  or  unisolated  gyro  or  accelerometer 
errors  exceed  the  flight  control  system  performance  detection 
levels  given  in  table  I of  paragraph  3. 2. 1.4. 2.  Coverage  of  FDI 
capability  external  to  the  INUrS  shall  be  assumed  to  be  unity  for 
both  fail-op  levels. 

* Cove rage  is  defined  as  the  probability  of  recovery  from  a given 
fail ure. 
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Provisions  for  reliability  improvement  by  use  of  external 
radio  aid  update  information  to  resolve  the  rare  3-gyro  isolation 
ambiguity  shall  be  included.  Increased  coverage  from  this  means 
shall  not  be  included  in  the  previous  INU  reliability 
calculations . 

The  mature  in-service  MTBF  of  each  INM  shall  be  greater  than 
3000  hours. 

3.2.4  Maintainability 

3. 2. 4.1  Maintainability  Design 

Plug-in  assembly  construct  ion  shall  be  used  to  the  greatest 
extent  practical.  All  modules  bearing  the  same  part  number  shall 
be  interchangeable.  As  a goal,  electronic  modules  shall  not 
require  adjustment  or  recalibration  after  replacement.  Care 
should  be  exercised  in  locating  and  mounting  of  modules  and  com- 
ponents for  ease  of  accessibility. 

Each  aircraft- replaceable  unit  shall  have  a failure  indicator, 
visible  from  the  front  panel  which  indicates  that  one  or  more  of 
the  internal  modules  has  failed.  This  indication  shall  be  present 
with  or  without  power  applied  to  the  system  and  shall  only  be 
reset  after  repair. 

Highly  reliable  self-test  shall  be  included,  consistent  with 
redundancy  management  requirements.  All  self-test  provisions 
shall  be  continuous  and  automatic,  with  no  pilot-initiated  tests. 

Sufficient  unit  test  points  shall  be  included  to  allow  fault 
isolation  to  the  module  level  using  factory  or  field  test  equipment. 
Module  test  points  shall  be  provided  to  allow  fault  isolation  to 
the  failed  component  without  probing. 

3. 2. 4. 2 Maintainability  Specification 

The  time  to  remove  and  replace  an  INM  in  the  aircraft, 
assuming  adequate  accessibility,  shall  be  less  than  one  minute. 
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including  mechanical  alignment  registration  as  defined  in  para- 
graph 3. 2. 2. 4.  Normal  functioning  of  the  other  three  INMs  shall 
not  be  disturbed  during  this  process. 

3. 2. 4. 3 Adjustments 

Manually-activated  on-aircraft  adjustments,  alignments  or 
calibrations  shall  not  be  required  by  the  INUrS-  Adjustment, 
alignment,  or  calibration  devices  shall  not  be  accessible  during 
normal,  on-aircraft  handling.  The  INUrS  shall  require  no  periodic 
mai ntenance . 

Automatic  self-biasing  methods  using  entered  ramp  position 
coordinates  (accurate  to  ±2  km) , gyro compassing  alignment  pro- 
cedures, and  terminal  position  and  velocity  indications  shall  be 
used  to  the  extent  practical  to  maintain  system  performance 
within  required  bounds  over  long  periods  of  time. 

3.2.5  Environmental  Conditions 

The  redundant  strapdown  INS  shall  be  designed  in  accordance 
with  ARINC  414  except  as  modified  herein,  and  be  capable  of  being 
tested  in  accordance  with  RTCA  Paper  120-61/DO-108 , with  condi- 
tions modified  to  be  consistent  with  this  specification. 

3.2. 5.1  Ambient  Temperature 

Normal  ambient  temperature: 

Maximum  continuous  operation: 

Short  term  (30  min)  overtemp: 

Low  operating  temp: 


30  °C 
50  °C 
71  °C 
-15  °C 
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3.2. 5.2  Vibration 

3. 2. 5. 2.1  General 

The  1N(Jrs  shall  be  capable  of  operation  during  vibration  as 
specified  by  RTCA  Paper  120-6 1/DO- 10 8 , Category  A.  This  vibra- 
tion level  consists  of  a constant  total  excursion  of  0.76  mm  from 
10  to  55  cps  with  a maximum  of  5 g,  and  of  5 g from  55  to  500  cps . 

3. 2. 5. 2. 2 Performance  Vibration 

The  angular  and  linear  vibrations  present  during  flight  to  be 
used  for  performance  estimates  are  shown  in  table  A-II.  These 
shall  be  considered  3 sigma  environments,  present  during  50  per- 
cent of  the  flight,  with  a phase  correlation  between  axes  of  0.3. 


TABLE  A-II.  MAXIMUM  PERFORMANCE  ENVIRONMENT 


SINUSOIDAL 

RANDOM 

Linear 

0. 3 g @28  Hz 

^rms 

0.00045  (g  ) 2/Hz 

Jrms  7 

0-200  Hz  (0-3  g } 

^rms 

Angular 

1.0  deg/sec  @15  Hz 

rms 

0.033  (deg/sec  ) 

rms 

Hz 

0-30  Hz  (1.0  deg/ 

sec  ) 

rms 

Linear/ angular 

01  grms-deg/secrms  915  Hz 

0-0033  ( ^rms'^eg/ 

sec  ) /Hz 

rms  7 

0-30  Hz  (0.1  g 

^rms 

deg/sec  ) 

^ rms 
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3.2.5. 2. 3 Motion  During  Ground  Alignment 

Coning  motion  of  the  vehicle  shall  be  assumed  to  occur  during 
ground  alignment  with  a cone  whole-angle  of  four  arc  minutes,  at 
a frequency  between  1 and  4.5  Hz.  Sudden  pitch  or  roll  rotations 
of  0.5°  shall  also  be  assumed.  Motion  of  the  aircraft  due  to 
wind  gusts  shall  be  assumed  to  be  a first-order  Markov  process 
with  a standard  deviation  of  4 mm  with  a correlation  time  of 
20  seconds. 

3 . 2 . 5 . 3 Shock 

Operational:  6 g with  a time  duration  of  at  least  10  milli- 

operaci  ^ ^ accordance  with  the  procedure  of 

RTCA  Paper  120-61/DO-108. 

Crash  Safety:  15  g with  a time  duration  of  at  least  10  milli- 
sec. , in  each  direction. 

3. 3 Design  and  Construction 

3.3.1  Electromagnetic  Interference 

The  redundant  strapdown  INS  shall  meet  the  conducted  and 
radiated  susceptibility  and  emission  requirements  of  ARINC  413, 
and  the  test  requirements  of  RTCA  Paper  120-61/DO-108 , for  Cate- 
gory A equipment.  Grounding  and  shielding  practices  shall  be  used 
in  accordance  with  ARINC  413. 

3.3.2  Humidity 

The  redundant  strapdown  INS  shall  be  capable  of  normal  opera- 
tion during  conditions  of  a relative  humidity  varying  from  10  per- 
cent to  100  percent,  combined  with  temperature  and  altitude  cycling 
encountered  in  normal  aircraft  operation,  as  defined  by  ARINC  414, 
for  Category  A (Std)  environment. 
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3.3.3  Explosive  Atmosphere 

Explosive  atmosphere  is  not  normally  encountered  by  elec- 
tronics equipment  in  airline  type  aircraft.  Specific  installa- 
tions where  explosive  vapor  presents  an  operating  hazard  are 
normally  defined  by  the  airframe  manufacturer. 

3.3.4  Atmospheric  Pressure 

Normal  atmospheric  pressure  range  is  from  -305  m to 
13,700  m.  Decompression  from  a pressure  altitude  of  2100  m to 
13,700  m in  15  seconds  or  less  shall  not  degrade  system  per- 
formance, per  ARINC  414. 

3.4  Logistics 

The  INURS  design  shall  be  compatible  with  the  following 
maintenance  structure: 

Level  1 Unit  replacement,  in  aircraft 

Level  2 Module  replacement,  in  the  shop 

Level  3 Module  repair  (excluding  gyros  and 

accelerometers ) 

Level  4 Gyro/Accelerometer  repair 

Level  1 maintenance  shall  not  require  the  use  of  any  standard  or 
special  test  equipment. 

3. 5 Major  Component  Characteristics 

3.5.1  Inertial  Measurement  Module  (IMM) 

The  IMM  shall  consist  of  one  two— degree— of— freedom,  tuned- 
gimbal  gyro,  two  singie-degree-of -freedom  accelerometers,  with 
supporting  loop-closure  electronics.  Compensation  coefficients 
for  use  in  software  for  correction  of  systematic  instrument  errors 
shall  be  contained  in  a memory  which,  when  installed,  may  not  be 
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altered  by  any  means.  Self-test  capability  shall  be  included  to 
detect  loop-closure  failures. 

3.5.2  Digital  Computer 

The  digital  computer  shall  be  of  the  general  purpose  type 
with  the  instruction  sequence  and  constants  stored  in  a memory 
which,  when  installed,  may  not  be  altered  by  any  means. 

Space  in  the  INM  chassis  shall  be  included  for  expansion  of 
instruction  memory  by  100  percent  from  that  needed  for  the  INU^g 
problem  as  defined  in  this  specification.  Spare  computer  execu- 
tion time  shall  also  be  provided,  for  greater  than  100,000  instruc- 
tions per  second  with  an  average  instruction  mix  as  shown  in 
table  A— III. 

TABLE  A- I II.  SPARE  CAPACITY  INSTRUCTION  MIX 


TYPE 

Load/ Store 
D- Load/Store 
Copy 

Exchange 

D-Shift 

Add/ Sub 

D-Add/Sub 

Multiply 

D-Multiply 

Divide 

Transfer 


PERCENTAGE 

UTILIZATION 

11.9 

31.8 

5.5 

4.2 

9.1 

10.5 

13.1 

6.4 

5.5 
0.6 
1.4 
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A portion  of  the  computer  memory  shall  be  non-volatile  with 
removal  of  aircraft  power.  Last-computed  values  of  the  following 
variables  shall  be  retained  following  normal  or  failure-mode 
power  shut  down,  for  a time  duration  of  over  30  days  without 
external  power: 

a.  Calibration  constants  which  are  modified  during  the 
course  of  normal  operation. 

b.  Latitude,  longitude,  velocities,  and  quaternions. 

c.  Maintenance  data,  e.g.,  self-test  results,  FDI  informa- 
tion, etc. 

Computer  self-test  provisions  shall  be  included  such  as: 

a.  A watchdog  timer  not  driven  from  the  main  computer 
clock,  periodically  reset  under  software  control, 
indicating  a failure  if  not  reset 

b.  Instruction  tests 

c.  Memory  tests 

d.  I/O  tests 

3.5.3  Computer  I/O 

Input/output  provisions  for  interfacing  the  computer  with 
the  various  peripheral  elements  shall  be  included: 

a.  Interface  with  one  IMM  including  the  calibration 
constant  memory  and  temperature  sensors. 

b.  Interface  with  external  avionics  via  ARINC  575 
transmitter/ receivers . 

c.  Interface  with  up  to  three  other  INMs . Particular  care 
must  be  taken  in  the  design  of  this  circuitry  to  avoid 
single-point  INURg  failure  modes. 
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3.5.4  Power  Supply  and  Support  Electronics 

The  power  supply  design  shall  include  monitoring  circuits 
for  over-voltage,  under-voltage,  and  short  circuit  protection. 
Automatic  shutdown  shall  occur  during  failure  modes  to  avoid 
potentially  hazardous  or  chain-failure  conditions. 

Computer  and  IMM  clock  and  timing  circuitry  shall  be  included 
Provision  for  synchronization  of  all  software  executive  inter 
rupts  shall  be  included  to  avoid  errors  due  to  time-skew  of  sensor 
data  readouts.  Particular  care  must  be  taken  in  the  design  of 
this  circuitry  to  avoid  single-point  INUrS  failure  modes. 
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APPENDIX  B 


PARITY  EQUATIONS 
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Parity  Equations 

Parity  equations  will  now  be  derived  for  the  semioctahedral 

spin  axis  orientation.  Equations  are  based  on  TDF  gyro  measure- 
ments. 

Test  relations  for  a semioctahedral  array  are  obtained  as 
follows.  Four  unit  spin  vectors  are  defined  (S.,  i = 1,  2,  3,  4) 
normal  to  and  directed  outward  from  the  four  triangular  faces  of 
a semioctahedron,  (figure  B-l) . From  symmetry  considerations  the 
following  useful  relations  can  be  obtained. 


4 


The  output  planes  (sensitive  axes)  of  the  TDF  gyros  lie  in  the 
triangular  faces  of  the  pyramid,  hence,  a set  of  parity  equations 
can  be  constructed  by  resolving  the  gyro  output  rates  along  the 
pyramid  edges  and  comparing  them.  This  leads  to  six  independent 
comparisons  and  can  be  formalized  as  follows.  First,  find  the 
unit  edge  vectors  of  the  pyramid.  These  edge  vectors  must  be 

perpendicular  to  the  adjacent  spin  vectors.  Thus  edqe  vector  e. 

^ ^ J i i 

can  be  defined  from  the  spin  vectors  and  S.  as: 


e . . 

13 


i ? 3 
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Since 


we  have 


thus 


(2) 


Now  suppose  the  output  rate  of  the  ith  gyro  is  W.  and  the 

— K 1 

3 th  gyro  . Then  we  can  define  the  parity  test  as: 


* 

T.  . 
i 3 


or 


* 

T.  . 

13 


i t j 


i f j (3) 


Now,  before  proceeding,  note  that  T*  ^ = T*^ , since  both  the  sign 
of  the  rate  difference  and  the  edge  vector  sign  change  on  inter- 
change of  index.  Thus  the  test  equations  can  be  written  as 


(W.  - W)  • e. . 
i 3 13 


i < j 
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or  expanding 


* 

T12  = 

(w1 

- W2) 

e12 

* 

T = 

13 

(Wx 

- w3) 

e13 

* 

T14  = 

(Wi 

- w4) 

e14 

* 

T = 

l23 

(W2 

- w3) 

A 

e23 

* 

T = 

24 

(w2 

- w4> 

e24 

★ 

T34  = 

(W3 

- w4) 

G34 

In  reality  the  gyros  do  not  output  rates  but  incremental 
angles 


/(n+1)  At 

Wi  dt 

nAt 


Furthermore,  these  incremental  angles  have  "noise"  components. 
Hence,  it  is  desirable  (necessary)  to  filter  them.  For  the 
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purposes  of  this  treatment  we  define  T. . = filtered^  (T*.) 
the  test  equations  become  ^ 

T.  . = filtered  jw.  - W . ! • e.. 

( 1 13 


i 1 • • • 4 , i < j < 4 


For  example  a first  order  filter  of  the  form 


Ti  . ( (n+1)  At) 


K T± j (nAt)  + t*  ( (n+1)  At) 


might  be  employed. 


(n+1) At 


e-k(t-T) 


T*  . dt 
ID 


B-6 


thus 


1 
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APPENDIX  C 
LOGISTICS  ANALYSIS 
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LOGISTICS  ANALYSIS 
VTOL  Operations 

1.  OPERATIONAL  CRITERIA 
1.0  SYSTEM  UTILIZATION 


TYPICAL  ROUTE  PLAN 


Ground  Operations  (Power  on)  6.5 


Unloading/Loading : 

3.5 

3.5 

3.5  3.5 

Ascent 

2.5 

2.5 

2.5  2.5 

Cruise 

6.0 

6.0 

6.0  6.0 

Descent 

3.0 

3.0 

3.0  3.0 

Servicing  (Power  off) 

8.5 

Total  Time  (Minutes) 

21.5 

15.0 

15.0  23.5 

Total  Flight  Time  per  Route 

46.0  Minutes 

Total  Ground  Operating  Time 

(Power  On) 

20.5  Minutes 

Total  Time  for  One  Complete 

Cycle 

75.0  Minutes 
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1.1  OPERATIONAL  MODES: 

Peak  Demand  Period  6:00  AM  to  6:00  PM 

Reduced  Operational  Period  - 6:00  PM  to  6:00  AM 


OPTIONS : 


Time  Between 

Port  Stops 

Peak 

Reduced 

A.  1 

Aircraft  per 

Route 

90 

Minutes 

120  Minutes 

B.  2 

Aircraft  per 

Route 

45 

Minutes 

60  Minutes 

C.  3 

Aircraft  per 

Route 

30 

Minutes 

45  Minutes 

D.  5 

Aircraft  per 

Route 

15 

Mi nutes 

30  Minutes 

_ A 

_B_ 

C_ 

D_ 

Total 

Routes  Flown 

per  day : 

14 

28 

40 

72 

Peak  Period 

8 

16 

24 

48 

Reduced  Operations  Period 

6 

12 

16 

24 

Slack 

Time  Between 

Flights 

(Minutes) 

Peak  Period 

15 

15 

15 

0 

Reduced  Operations  Period 

45 

34 

60 

75 

Total 

Operating  Hours  per  day 

15.52 

31.10 

44.33 

79 . 80 

Avg . 

Operating  Hours  Per  A/C/ 

15.52 

15.50 

14.78 

15.96 

day 

Total 

Flight  Hours 

per  day 

10.73 

21.47 

30.67 

55.20 

Avg . 

Flight  Hours 

per  A/C/ 

10.73 

10.73 

10.22 

11.04 

day 


1.2  OPERATIONAL  SITES: 

Gi  ven 

Assuming  90%  Operational 
Readiness 


200  Aircraft  In  Inventory 

= 180  Aircraft  Operational 
= 20  Aircraft  In  Maintenance 
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Assumin 

g one  (1)  Main 

Base  has 

five 

(5)  separate  routes,  then: 

TOTAL 

TOTAL 

OPTION 

OP: A/C  BACKUP 
REQD  A/C 

TOTAL 

A/C 

MAIN 

SATELLITE 
BASES  PORTS 

OPER.  SITES 

A 

5 1 

6 

30 

450 

4 80 

B 

10  1 

11 

16 

240 

256 

C 

15  1 

16 

11 

165 

176 

D 

25  1 

26 

7 

105 

112 

1.3  OPERATING  TIME: 

OPTION 

AVG.  FLIGHT 
HRS.  PER  DAY 

NO.  OF  A/C 
IN  USE 

TOTAL  FLIGHT 
HRS.  PER  MON. 

OP/ FT  HR 
RATIO 

A 

10.73 

150 

48,285 

1.444  : 1 

B 

10.73 

160 

51,504 

1.444  : 1 

C 

10.22 

165 

50,589 

1.446  :1 

D 

11.04 

175 

57,960 

1.445  : 1 

1.4  ESTIMATED  RELIABILITY: 

Channel  : 3,000  Hours  MTBF  (4  per  aircraft) 

Consisting  of: 

IMM:  6,000  Hours  MTBF 

COMPUTER:  7,500  Hours  MTBF 

POWER  SUPPLY:  30,000  Hours  MTBF 

Unit:  750  Hours  MTBF  (1  per  aircraft) 

1.5  FAILURES 

1.5.1  "Hard"  Failures,  or  "Soft"  Failures  exceeding  system 
degradation  limits,  encountered  in  flight  will  require  removal 
and  replacement  of  failed  unit  at  next  ground  operational  site. 
Take-off  for  next  leg  of  route  will  not  be  attempted  until  all 
INS  Units  operational. 
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1.5.2  "Soft"  failures  in  flight,  not  exceeding  system  degradation 
limits,  will  require  system  monitoring  until  return  to  the  main 
base  where  the  faulty  unit  will  be  removed  and  replaced. 

1.6  MAINTENANCE: 

1.6.1  Maintenance  at  satellite  ports  restricted  to  removal  and 
replacement  of  INS  units  within  3 minutes  (1  minute  installation 
time)  using  minimal,  common  hand  tools. 

1.6.2  Maintenance  at  the  main  operating  base  shall  consist  of: 

a.  Fault  verification  and  removal  and  replacement  of  failed 
INS  Units. 

b.  Fault  detection  and  isolation  to  replaceable  assembly 
within  the  INS  unit;  removal  and  replacement  of  failed 
replaceable  assembly;  and  repair  verification. 

2.0  INITIAL  AND  REPLACEMENT  SPARES  COSTS.  (INS  Unit  only  — 
modules  not  included) 


C1 

= 

(STK)  (H)  (UC)  ♦ <PFH)  (UF^PA)  (1' 

RIP) (DRCT) (UC) 

Where : 

1 Box  4 Box 

STK 

= 

Stock  Level  at  a site  (units) 

1 

M 

= 

Number  of  Operating  Sites 

Ref.  Para.  1.2 

UC 

= 

Unit  Cost 

90K  23.75K 

PFH 

= 

Peak  Flying  Hours  per  Month 

- Ref.  Para.  1.3  - 

UF 

= 

Ratio  of  Operating  Hours  to 
Flying  Hours 

Ref . Para . 1.3- 

QPA 

= 

Quantity  of  Like  Items  per 
Aircraft 

1-4 

RIP 

= 

Fraction  of  Failures  which  can 
be  repaired  in  place 

\ 

o 

o 

• 

1 

MTBF 

= 

Mean  Time  Before  Failure  in 
Operating  Hours/Box 

750  3000 

DRCT 

= 

Average  Repair  Cycle  Time 
(In  months) 

.0667  - .0500 
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2-l  Spare  Units  Stocked  at  Sites: 

2.1.1  One  Box  Inertial  Navigation  System 

Option  A.  = (1)  (480)  (90K)  + (-Hi285>  d-444>  d>  U-0)  (.0667)  (9Qk) 
= $43,758,067. 

B.  = (1)  (256)  (90K)  + L81^04)  (I.444)  (D($6y003j) 

= $23,635,272. 

C.  = (1)  d76)  (90K)  + (J°>589)  (I-446)  (1)  ($6>003>) 

= $16,425,506. 

D.  = (1)  (112)  (90K)  + L5?f960)  (I.445)  (1)  ($6>003  ) 

- $10,750,353. 

2.1.2  Four  Box  Inertial  Navigation  System 
Option  A.  = (1) (480) (23. 75K) 

= $11,510,396 

B.  = (1)  (256)  (23. 75K) 

= $6,197,755. 

C.  = (1)  (176)  (23. 75K) 

= $4,295,824 

D.  = (1) (112) (23.75K) 

= $2,792,608 

06 


+ (48,285)  U.444M4)  <1-0,,  05,(23  75k[ 


+ (51,504)  <1,444)  (4) 

3000  l$l,i8/. 


50) 


+ .50,589)  <1.4o46)  (4)  |n  i87  50) 


+ (57,960)  <1,445) (4) 

3000  Ifci/iB/. 


50) 


l 
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2.2  On-Board  Spares  (1  Replacement  Unit  per  Aircraft) 

C - (Operational  Aircraft)  + (Standby  Aircraft)  + (Repair 
2 Pipeline  Units) 

2.2.1  One  Box  Inertial  Navigation  System: 

Option  A.  = (1) (150) (90K)  + (1)(30)(90K)  + 558,067 

= $16,758,067. 

B.  = (1)  (160)  (90)  + (1)  (16)  (90)  + 595,272 
= $16,435,272 

C.  = (1)  (165)  (90)  + (1)  (11 ) (90)  + 585,506 
= $16,425,506 

D.  = (1)  (175)  (90)  + (1)  (7)  (90)  + 670,353 

= $17,050,353 

2.2.2  Four  Box  Inertial  Navigation  System: 

Option  A.  = (1)  (150)  (23.75K)  + (1 ) ( 30 ) (2 3 . 75K)  + 110,396 
= $4,385,396 

B.  = (1)  (150)  (23.75K)  + (1)  (16)  (23.75K)  + 117,755 
= $4,060,255 

C.  = (1)  (165)  (23. 75K)  + ( 1 ) ( 11 ) (2 3 . 75K)  + 115,824 

= $4,295,824 

D.  = (1)  (175)  (23. 75K)  + (1)  (7)  (23 . 75K)  + 132,608 
= $4,455,108 

3.0  ON-AIRCRAFT  MAINTENANCE  COSTS  (MONTHLY) 

r _ ( PFH ) ( UF)  ( QPA)  + (RMH  + RVH)  ] (BLR  + DDR) 

'”3  MTBF 
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Where 


1 BOX 

4 BOXES 

PFH 

= 

Peak  Flying  Hours  per  Month 

- Ref. 

Para. 

1.3  - 

UF 

= 

Ratio  of  Operating  Hours  to 
Flying  Hours 

- Ref. 

Para. 

1.3- 

QPA 

= 

Quantity  of  Like  Items  per  Aircraft 

1 

4 

MTBF 

= 

Mean  Time  Before  Failure  in 
Operating  Hours 

750 

3000 

PAMH 

= 

Average  Manhours  for  Preparation 
and  Access  to  Unit 

- 1 Min/4  Min 

- 

RMH 

— 

Average  Manhours  to  Remove  and 
Replace  Unit 

2 

Min 

- 

RVH 

— 

Average  Time  to  Verify  Restoration 
of  System  to  Operational  Status 

10  Min 

• 

5 Min 

BLR 

= 

Basic  Labor  Rate  for  Maintenance 
Personnel 

- $24. 

Hr 

- 

DDR  = Dispatch  Delay  Rate 
3 . 1 Not  Requiring  System  Shutdown 


- $3,000.  Hr 


3-1-1  Four  Box  Inertial  Navigation  System 
3. 1.1.1  On-Board  Spare  Available 

Option  A.  = — >285) 75q444)  ~ [-0166  + (.0333  + .0083)]  ($24.  +$3,000 
= $18,681 

B.  - 151,504)  U.444)  (1)  , .0582)($3,O2«., 

= $17,207. 

C.  - <50,589, U. 446) (1), .0582,(83,024 

= $17,165. 

D-  - ^-96°><;-445)(1)(.0582)  163,024.) 

= $19,653. 
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3. 1.1. 2 Replacement  Spare  Stocked  at  Site 


Option  A.  = (48,285) 75q444)  (1~  [-0667  + (.0333  + .0083)]  ($24.  + 
= $35,512 

B.  = (51,504)  U.444)  (1)  (>1083)  ($3,024.) 

= $32,036. 

C.  = (50,589) ^1^446 ) (1)  (>1083)  ($3fQ24.) 

= $31,941. 

D.  = (57'96Q)  ^q445)  — (.1083)  ($3,024.) 

= $36,572. 

3.2  Requiring  System  Shut  Down  During  Maintenance 

3.2.1  One  Box  Inertial  Navigation  System 

3. 2. 1.1  On-Board  Spare  Available 


Option  A. 


B. 


C. 


(48,285)  (1.444)  (4) 
3000 

($24.  + $3,000.)  = 


(51,504)  (1.444)  (4) 
3000 


[.0166  + (.0333  + .1667 
$69,561 

(.2167) ($3,024.) 


] 


$64 ,102 

(50,589)  (1.446)  (4) 
3000 


(.2167)  ($3,024.) 


$63,912. 


$3,000) 
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Option  D.  = 


_ (57,960) (1.445) (4)  . 

~ JOOO (.2167)  ($3,024.) 


= $73,177. 


3. 2.1.2  Replacement  Spare  Stocked  at  Site 


Option  A.  = 


(48,285)  (1.444)  (4)  

30qo [-0667  + (.0333  + .1667)] 


= $87,452 


n _ (51,504)  (1.444)  (4)  . .. 

B-  ~ 3000 (.2667)  ($3,024.  ) 


C. 


D. 


$78,892. 

(50,589)  (1.446)  (4) 
3000 


(.2667)  ($3,024.) 


$78,658. 

(57,960)  (1.445)  (4)  (.2667)  ($3,024 . ) 
$90,062 . 


4 • 0 OFF-AIRCRAFT  MAINTENANCE  COSTS:  (MONTHLY) 


C4  = 


( PFH ) (UF) (QPA) 


MTBF 


[ (RTS)  (BMH)  (SLR  + SMR)  ] 


Where : 
PFH 
UF 

QPA 

MTBF 

RTS 


1 BOX  4_ 

Peak  Flying  Hours  per  Month  - Ref.  Para 

Ratio  of  Operating  Hours  to  - Ref.  Para 

Flying  Hours 

Quantity  of  Like  Items  per  Aircraft  1 

Mean  Time  Between  Failure  in  750 

Operating  Hours 

Fraction  of  Units  Expected  to  be  1.00 

Repaired  at  Main  Base 


BOXES 
1.3- 
1.3  - 

4 

3000 
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1 

= Average  Manhours  to  Perform  Shop  3 
Maintenance  on  failed  units 
including  fault  isolation,  repair, 
and  verification  (INS  Unit  only  - 
module  repair  not  included) 

SLR  - Shop  Labor  Rate  per  Hour 

SMR  = Shop  Material  Consumption  Rate  per  - 
Hour 


4 . 1 One  Box  Inertial  Navigation  System 


Option  A. 


(48.285)  (1.444)  (1) 
7"50 


[ (1) (3) ($34 


+ $16)] 


B. 


(51,504)  (1.444)  (1) 
750 


($150.) 


C. 


(50,589)  (1.446)  (1) 
750 


($150. ) 


D. 


(57,960)  (1.445)  (1) 
750 


($150. ) 


4.2  Four  Box  Inertial  Navigation  System 


Option  A.  = (48f285>  (300Q4) (4J  [ (1) (2> ($34*  + $16 


B. 


_ (51,504)  (1.444)  (4)  ■,  nn  ? 

3000 


(50,589)  (1.446)  (4_)  ($100  } 
C.  = 3000 (5IUU.) 


(57,960)  (1.445)  (4J  ,$100  } 
D.  = 3000  ^iUU,) 


BOX  4 BOXES 
2 

$34  . 

$16. 

= $16,265 
= $14,673. 

= $14,628. 

= $16,750. 

) ] = $10,843. 
= $9,783. 

= $9,753. 

= $11  ,167 . 
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5 - 0 LIFE  CYCLE  MAINTENANCE  COSTS 
Assuming : 

Service  Life  of  Inertial  Navigation  System  = 10  years 
Increase  in  Reliability  = 5000  Hours  MTBF  for  mature  system 


5.1  On  Aircraft  Maintenance  Costs 


Where : 

C3 

K 


C5  = [C3  - (K) (C3) ] (1UP) 


= Monthly  On-Aircraft  Maintenance  Costs 


- Adjustment  Factor  to  establish  Average 
Monthly  Costs  over  Program  Period 

1UP  = Inventory  Usage  Period  (Operational  Ser- 
vice Life  of  System  in  Months) 

5.1.1  Spares  at  Site 
OPTION  BOXES 


Ref.  Para . 3.0 

20% 

120 


A 

1 

(87,452  - 

(.2)  (87,452) ] 

(120) 

= 

$8,395,390. 

4 

[35,512  - 

(.2) (35,512) ] 

(120) 

= 

$3,409,130. 

B 

1 

[78,892  - 

( .2)  (78,892) ] 

(120) 

= 

$7,573,632 

4 

[32,036  - 

( .2) ( 32,036) ] 

(120) 

= 

$3,075  ,456. 

C 

1 

[78,658  - 

(.2) (78,658) ] 

(120) 

= 

$7,546,848. 

4 

[31,941  - 

(.2)  (31 ,941)  ] 

(120) 

= 

$3,066,336. 

D 

1 

[90,062  - 

( .2) (90,062) ] 

(120) 

= 

$8,645,952. 

4 

[36,572  - 

( .2) (36,572)] 

(120) 

= 

$3,510,912. 

1.2  Spares 

On- 

■Board 

OPTION 

BOXES 

A 

1 

[69,561  - 

(.2) (69,561) ] 

(120) 

$6,598,907. 

4 

[18,681  - 

(.2) (18,681) ] 

(120) 

= 

$1,793  ,413. 

B 

1 

[64,102  - 

( .2)  (64,102)  ] 

(120) 

- 

$6 ,153 ,792. 

4 

[17,207  - 

(.2) (17,207) ] 

(120) 

- 

$1,651,872. 
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OPTION  BOXES 


c 

1 

[63,912  - 

- { .2) (63,912)J 

(120) 

= $6,135,552. 

4 

[17,165  ■ 

- (.2) (17,165) ] 

(120) 

= $1,647,840. 

D 

1 

[73,177  ■ 

- (.2)  (73,177) ] 

(120) 

= $7,024,992. 

4 

[19,653  ■ 

- ( .2)  (19,653) ] 

(120) 

= $1,886,688. 

5.2  Off 

Aircraft  Maintenance 

Costs 

C6 

- [<c4> 

- (K) (C4) I (1UP) 

Where : 

C4  = 

Monthly  Off 

Aircraft 

Maintenance  Costs 

OPTION 

BOXES 

A 

i 

[16,265 

- (.2) (16,265)] 

(120) 

= $1,561,454. 

4 

[10,843 

- (.2) (10,843) ] 

(120) 

= $1,040,969. 

B 

1 

[14 ,673 

- (.2)  (14,673)1 

(120) 

= $1,408,608. 

4 

[ 9,783 

- (.2) ( 9,783)1 

(120) 

= $ 939  ,168. 

C 

1 

[14,628 

- ( .2) (14,628) 1 

(120) 

= $1  ,404,288. 

4 

[ 9,753 

- (.2) ( 9,753) ] 

(120) 

= $ 936  ,288. 

D 

1 

[16,750 

- ( .2) (16,750) ] 

(120) 

= $1,608,000. 

4 

[11,167 

- (.2) (11,167) 1 

(120) 

= $1,072,032. 

6.1  One  Unit  vs  Four  Unit  Inertial  Navigation  System 


6.1.1  Spares  Stocked  at  Sites: 

UNITS  INITIAL  & RPL'MT 
OPTION  PER  A/ C SPARES  COST 

A 1 43.8 

4 11.5 

DELTA  COST:  32.3 


LIFE  CYCLE 
ON  A/C 

M COST 
OFF  A/C 

TOTAL 

($000,000) 

8.4 

1.6 

53.8 

3.4 

1.0 

15.9 

5.0 

.6 

37.9 
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OPTION 

UNITS 
PER  A/C 

INITIAL  & RPL'MT 
SPARES  COST 

LIFE  CYCLE  M COST 
ON  A/C  OFF  A/C 

TOTAL 

($000,000) 

B 

1 

23.6 

7.6 

1.4 

32.6 

4 

6.2 

3.1 

.9 

10.2 

DELTA 

COST: 

17.4 

4.5 

. 5 

22 . 4 

C 

1 

16.4 

7.6 

1.4 

25.4 

4 

4 . 3 

3.1 

.9 

8.3 

DELTA 

COST: 

12.1 

4.5 

. 5 

17.1 

D 

1 

10.  8 

8.7 

1.6 

21.1 

4 

2.8 

3.5 

1.1 

7.4 

DELTA 

COST: 

8.0 

5.2 

.5 

13.7 

6.1,2  On 

Board  Spares : 

A 

i 

16. 8 

6.6 

1 . 6 

25.0 

4 

4.4 

1.8 

1.0 

7.2 

DELTA 

COST: 

12.2 

4.8 

.6 

17.8 

B 

1 

16.4 

6.2 

1.4 

24.0 

4 

4.1 

1.7 

.9 

6 . 7 

DELTA 

COST: 

12.5 

4.5 

.5 

17.3 

C 

1 

16.4 

6.2 

1.4 

24.0 

4 

4 . 3 

1.7 

.9 

6.9 

DELTA 

COST: 

12.1 

4.5 

. 5 

17.1 

D 

1 

17.1 

7.0 

1 . 6 

25.7 

4 

4.5 

1.9 

1.1 

7.5 

DELTA 

COST: 

12.6 

5.1 

. 5 

18.2 
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7 . 0 CONCLUSIONS : 

a.  Initial  and  Replacement  Spares  Costs  for  a four  unit 
Inertial  Navigation  System  are  from  71  percent  to  76  per- 
cent less  than  a one  unit  Inertial  Navigation  System, 
regardless  of  whether  the  spare  units  are  stocked  at  the 
site  or  onboard  the  aircraft. 

b.  On-aircraft  maintenance  costs  for  a four  unit  Inertial 
Navigation  System  are  72  percent  less  than  a one  unit  INS 
when  onboard  spares  are  available  and  59  percent  less 
when  the  spare  unit  is  stored  on  site.  The  difference 

is  due,  in  part,  to  bringing  the  replacement  unit  aboard 
and  removal  of  the  faulty  unit  from  the  aircraft. 

c.  Although  initial  and  replacement  spares  costs  are  lower 
when  stored  at  the  site  (when  the  number  of  aircraft 
exceeds  the  number  of  sites),  the  difference  in  cost  is 
offset  by  the  increased  on-aircraft  maintenance  costs. 

d.  Off-aircraft  maintenance  costs  for  a four  unit  INS  are 
from  31  percent  to  35  percent  less  than  a one  unit  INS 
due  to  the  added  equipment  complexity  and  time  required 

to  fault  isolate  and  verify  repair  of  the  single  unit  INS. 

e.  it)tal  life  cycle  maintenance  costs  including  cost  of  spares 
is  over  $13M  greater  for  a one  unit  INS  than  for  a four 
unit  INS.  Initial  INS  procurement  penalty  is  only  5K 

x 200,  or  $1M,  for  a net  savings  of  $12M. 
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Strapdown  Gyro  Transfer  Function 

The  dynamic  model  of  the  strapdown  gyro  is  shown  in 
figure  D-l.  The  basic  equations  of  motion  of  the  strapdown  gyro 
are  determined  by  balancing  all  the  torques  acting  on  the  rotor. 
Torques  about  X: 


A0X  + DUX  + KD  °X  + Hc  °Y  + KQ  °Y  = ‘ H^y  “ A<t>x  + MeX  + MaX 


and  torques  about  Y: 


(1) 


A0y  + D0y  + Kd  0v  - Hc  6X  - Kq  6x 


= H»x  - A»y  + Mey  + May 


whore : 


(2) 


A = 


D = 


Rotor  moment  of  inertia  about  output  axes 

Damping  on  rotor  about  output  axes  relative  to  case 

D ■=  2A/t 


K. 


K 


Gyro  dynamic  time  constant 

'D  = In-phase  spring  rate  between  rotor  and  case  (function 
of  mistuning  parameter  AN)  K = H AN/F 

DC  m 

Quadrature  spring  rate  between  rotor  and  case • 

KQ  = 

Angular  momentum  of  rotor  for  rotor  displacements 
relative  to  case  for  no  case  rates,  i.e.,  I = £ = 0 

Hr  = (C  + A )N  X 

c g 


h = 


m 


Effective  angular  momentum  of  rotor  for  case  rates 
about  input  axes  for  rotor  moving  with  case,  i.e,, 

°X  = °Y  = °'  H = {Hc  ■ N (Aq  + Ba  ~ Ca)/2}  = Hr  U-1/2F  ] 

^ y g g c m 

Figure  of  merit  = Hc  N /KT>  where  KT  = sum  of  all 
torsional  spring  rates  of  suspension. 
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<j>  ,4>  , L : ANGULAR  RATES  OF  CASE 

X Y S RELATIVE  TO  INERTIAL  SPACE 

9,9:  ROTOR  ANGULAR  DISPLACEMENTS 

X Y RELATIVE  TO  THE  CASE  (PICKOFFS) 

N : SPIN  SPEED 

N : TUNED  SPEED  = ,/KT/(Ag  + Bg  “ Cg) 

K • SUM  OF  TORSIONAL  SPRING  RATES  ATTACHED  TO  GIMBAL 
T 

A : GIMBAL  MOMENT  OF  INERTIA  ABOUT  SHAFT -ATT ACHED  AXIS 
Bg  : GIMBAL  MOMENT  OF  INERTIA  ABOUT  ROTOR- ATTACHED  AXIS 

g 

C : GIMBAL  POLAR  MOMENT  OF  INERTIA 

g 

C : ROTOR  POLAR  MOMENT  OF  INERTIA 

AN  = N - N 
o 

Figure  D-l.  Dynamic  Model  of  Strapdown  Gyro 
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Max  and  May  are  torc3ues  applied  to  rotor  about  X and  Y 
respectively.  ^ex  an<^  ^ey  are  error  torques  generated  primarily 
bY  non-linear  terms  in  the  equations  of  motion.  The  primary 

terms  are: 


- -(C  - A)  j>s  <py  - Hijg  0X  - (C  - 2A)  is  0y  + A<ps  0y 

= (C  - A)  ps  <ix  - H<£s  0y  + (C  - 2A)  $s  0X  - A 4>'g  0X 


The  first  term  is  the  expression  for  the  anisoinertia  term  and  is 
present  even  for  an  ideal  perfectly  captured  gyro,  where 
0X  = 0Y  = 0.  The  second  term  is  the  cross  coupling  error  gener- 
ated  if  the  capture  loop  is  not  ideal  (Ox  and  0y  not  equal  to 
zero) . The  third  and  fourth  terms  are  other  error  terms  which 
are  also  generated  for  imperfect  rebalancing.  Additional  terms 
due  to  motor  hunting  are  discussed  in  another  section. 

Gyro  Transfer  Function  (Open  Loop) 

The  output  angle  0 (pickoff)  versus  input  angle  <f>  can  be 
determined  from  Equations  (1)  and  (2)  . Assume  <p^  — 0 and 
inoperative  capture  loops. 

Taking  the  Laplace  transform  and  expressing  in  matrix  form: 


2 

AS  + DS  + IJ  AN/F 
C m 

H (S  + l/l ) 

0 (S) 
X 

(S) 

-1 

- as24>x(s) 

-Hc(S  + 1/1) 

2 

AS  + DS  + iJ  AN/F 
C m 

Vs) 

HS(J)  (S) 

2 

- AS  <J>  (S) 

- 

4 

- 

(3) 


D— 4 


403314 


Solving  (3)  yields  (for  D <<  H^)  : 


Vs) 

*x(s) 


-s (S  + 1/t ) (s2  - DS/2A  + HH  /A2) 


(S  + 1/T) 2 + (AN/Fm) 2 


s: =r 

- 


S2  + DS/A  + (Hc/A)2 


Direct  Axis 


0 (s) 

Y 

$ (s) 


-Hc  s[s  - Fm/I  + /(F^)2  + 2ANH/A  ][s  - F^/T  - J 2ANH/a] 


2AF  | (S  + 1/T)2  + (AN/Fj2j[: 


TTl 


[‘ 


m 


2 2 
S + DS/A  + (H^A) 


] 


Cross 

Axis 


r 

— ■ — = Nutation  frequency  id 

A n 


for 


F >>  1 
m 


A typical  frequency  response  for  such  an  open-loop  gyro  is 
shown  in  figure  D-2. 
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RATIO  OF  PICKOFF  OUTPUT  0 TO  ANGULAR  DISPLACEMENT 
INPUT  0 VS.  FREQUENCY  (OPEN- LOOP) 

PARA  ME  TERS 


Figure  D-2.  Open-Loop  Frequency  Response  of  Strapdown  Gyro 
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Pendulous  Accelerometer  Analysis 

Below  is  a brief  analysis  of  a Pendulous  Accelerometer. 
Instrument  level  errors  and  dynamics  are  derived  and  error  magni- 
tudes evaluated. 

Instrument  axes  defined  by: 


(X,  Y,  Z) 
(OA,  PA,  IA) 
OA 
PA 


IA 


0 


Case  fixed  axes 

Principal  axes  of  accelerometer 

Output  axis 

Pendulous  axis 

Input  axis 

Pickoff  angle 


z 

Resolving  input  case  rates  along  principal  axes  to  first  order 
in  t) . 


U)IA 

= 

wz 

^PA 

= 

+ 

0u)z 

WOA 

= 

+ 

m 

U 

E-2 
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Input  acceleration  as  measured  by  instrument  is: 


aia  az  ” 0ay 


Since  (OA,  PA,  IA)  are  principal  axes,  angular  momentum,  H,  is 
related  to  angular  velocity  by  principal  moments  of  inertia  JQA, 


JIA ' JPA 


IA 

JIA 

(“z  “ 

3 

CD 

PA 

JPA 

+ 

>* 

3 

0UZ) 

OA 

JOA 

(o>x  + 

0) 

Equations  of  motion  are  obtained  from: 


SPACE  + 


SPACE  BODY  + “ X + 


The  equation  for  torques  along  the  OA  axis  is  then: 

“OA  + WPAHIA  " aJIAHPA  = MOA 
Substituting  for  co  and  H and  collecting  terms- 

JOA  (“X  + 0)  + “Y^Z  (JIA  " JPA)  + 6 (WZ2  " Q)Y2)  (JIA  “ JPA)  = MOA 
External  torques  to  the  system  along  OA  axis  are: 


«0A  = PAIi  - V - B6  + M, 
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Where 

P = Pendulosity  (Ml) 

Ky  — Torsional  restraint  of  suspension 
B = Rotational  damping 

= Applied  rebalance  torque 

Applying  equilibrium  of  moments,  we  have: 

J0A°  + 8(5  + K0°  = PAZ  + PAe  + Me 

Where  Ag  are  the  error  terms  measured  by  the  instrument: 


PAe  “ “y“z(JPA  - JIA> 


+ 0(“z2  - “y2)  <JPA  - JIA>  - JOA"x  - P0AY 


The  magnitudes  of  these  error  terms  will  now  be  evaluated  using 
the  A-1000  design  parameters. 


Anisoiner tia 


a = U)  u)  ( j — t \ /p 

O Y Z 1 PA  IA}  ' 


WYUZ 


— = 0.5  PG/(°/sec) 2 


Output  Axis  Sensitivity  (Not  Rectification) 


OA  • 

— QJ 

P X 
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With 


Governor 


j = 0 . 9 gm  - cm 

OA 


U = SIN  (2TFft) 

X 0 


= 210  uG/(°/sec)Hz 


U) 


X 


Effect 


“ = 0(-z2  ' “y2)  (JPA  JIA)/P 


a 


2 2 
0(u'Z  - ) 


0.5  yG/ ( ° /sec)  /rad 


a 

e 


GA 


Y 


Vibropendulous 
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APPENDIX  F 

DERIVATION  OF  DESIGN  EQUATIONS 
FOR  TETRAHEDRAL  ARRAY 
OF  4 TDF  GYROS 


F-l 
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APPENDIX  F 

DERIVATION  OF  LEAST  SQUARES  DESIGN  MATRIX  FOR  n 
TWO-DEGREE-OF -FREEDOM  GYROS  WHOSE  SPIN  AXES 
ARE  NOT  COLL I NEAR  ' 


When  the  instrument  cluster  consists  of  n TDF  gyros,  then  there 
are  2n  channels  that  contain  information  of  angular  rate  of  the 
cluster.  The  computed  angular  rate  of  the  cluster ,<u»,  is  related 
to  the  measured  angular  rates  of  the  cluster.  O',  through  the 
matrix  [ D J as  shown  in  Equation  (1)  . 


<uj>  = [ D]  £ (1) 


The  purpose  of  this  section  is  to  derive  and  define  the  design 
matrix  in  such  a way  that  the  sum  of  squares  of  the  errors  con- 
tributed by  all  2n  channels  is  minimized. 

Let  w represent  the  total  angular  rate  of  the  instrument  cluster. 

the  unit  vector  coincide  with  the  spin  vector  of  the 
gyro  and  represent  the  component  of  w that  is  perpendicular  to 
the  spin  axis  of  the  ith  gyro.  The  relationship  between  the  spin 
axis  of  the  ibn  gyro  and  the  various  vectors  is  shown  in 
figure  F-l . 


B 


Figure  F-l.  Spin  Axis  of  the  ith  Gyro  and  the  Angular 

Velocity  Vectors 
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It  is  noted  that  is  the  angular  velocity  vector  measured  by  a 
perfect  ith  gyro  and  this  vector  is  given  by  Equation  (2) 


The  dot  product  written  in  matrix  form  becomes 

S.  • TS  = [sT]  [=1  . (3) 

where 

[n]W  = [Sxi  syi  Szi] 


S gj  + S . <ii  t S ■ u> 

xi  x yi  y 21  z 

1 0 
1 

1 

1 

0 

1 

1 

1 

— — 

0 

1 

1 0 
1 

1 

1 

— L- 

1 

0 

• 

0 

1 

1 0 

1 

1 

o 

Where  Svi , Svi  and  Szi  are  components  of  the  unit  vector,  S.^, 
resolved  along  the  reference  coordinate  set  xyz  , and  wx<  wy  and 
uiz  are  components  of  total  angular  velocity  of  the  cluster  also 
resolved  along  the  same  set. 
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Substitute  (3)  into  (2)  and  express  in  matrix  form. 

K]  - [=]  - pj  p*]  [=] 

■ (W  - PJ  PIJ&]  • 

Let 

N - w-pJPl] 

Substitute  (6)  into  (5) 

[=i]  ' [si]t=]  • 

Expanding  (6)  we  obtain 


1 - s2. 

XI 

t 

\ 

i 

i 

-s  . s . . 

xi  yi 

1 

1 

I 

1 

-s  . s . “ 

XI  Zl 

7 

i 

) 

M ■ 

-s  . s . 

xi  yi 

i 

i 

i 

i 

L 

1 - s2. 
yi 

1 

i 

1 

1 

x 

-s  . s . 
yi  zi 

_ -s  . s 

XI  Zl 

i 

i 

i 

I 

-s  . s . 
yi  zi 

1 

1 

1 

1 

1 

1 - s2. 

Zl  J 

Examination  of  Equation  (7)  reveals  that  when  the  total  angular 
rate  vector,  w,  is  premultiplied  by  the  [S-]  matrix  the  resulting 
product  yields  a component  of  the  total  angular  input  rate  that 
ls  perpendicular  to  the  spin  vector  of  the  i^-^1  gyro.  Thus  ui  • 
represents  the  rate  vector  as  would  be  measured  by  a per feet1 i^h 
9Yro* . Similar  relationships  may  be  written  for  the  n TDF  gyros 
contained  within  the  instrument  cluster.  Thus, 


F-4 


403314 


hi  = KM 
hi  - hi  m 

Urn  C 

[“il  * [si]  3 

hi  : hi  ^ • 

Equation  (9)  may  be  written  as 


[c]  = [A]p]  . <“> 
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Where  [<lj  is  1 by  3n  matrix  representing  2n  measured  rates  and 
[aJ  is  the  3 by  3n  matrix  (sometimes  referred  to  as  the 
mapping  matrix).  [u>]  and  [a]  are  defined  by  Equations  (12)  and 


[=]  - 


[a]  - 


H 

H 

[*■] 


(12) 


(13) 
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Assuming  that  the  spin  axes  of  the  n gyros  used  are  not  collinear 
then  we  have  2n  available  measurements  that  represent  the  total 
rate  of  the  cluster.  There  is  a variety  of  ways  of  extracting 
the  desired  information  out  of  the  2n  measurements  available.  In 
our  approach  we  will  consider  the  least  squares  regression  method 
which  is  given  by  Equation  (14) 

<„>  = [aT  a]'1  [aT]  = <14) 

Comparing  Equation  (14)  with  Equation  (1)  it  is  noted  that 


[D]  = [A*  a]"1  [aT]  (15) 

Next  we  will  evaluate  the  least  squares  solution  for  matrix  [d] 
when  n TDF  gyros  are  present  and  operating  within  the  instrument 
cluster . 

Using  (13)  we  obtain 

[«’]  ■ [[*.’]■  M-  ■ ■ • M ■ ■ ■ M 

Examination  of  Equation  (8)  indicates  that 

[si]  - W • 

Applying  (17)  to  (16) 

[aT]  = [[si]'  [S2]'  ' ’ * [Si]'  ' * * [Sn]]  (18) 
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And  thus 

[aT]  [a] 


From  Equation 


But  since 


[ [Sl]'[S2] [Si] [sn]] 


M 

HI 

[>i] 

- 


= [sj2  + [s2p  ♦ ...+  [s.]2  +...+  [sn]: 


(19) 


(6) 


•J 


]2  ■ 

’l  - g.  §T1 

A Am"| 

I - S.  S 

J 

L 1 XJ 

L 1 J 

A AT  A AT  A At 

= I - 2 S . S . + S.  S.S.  ST 
li  1111 


(20) 


AT  A 

s:  s.  = l 

i i 


(21) 
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Then  Equation  (20)  becomes 


[■J 


= 1 - 


A AT 

Si  Si 


- M 


(22) 


Using  Relationship  (22)  in  Equation  (19)  we  have 

[at]  [a]  - 0J  + H M +-+  W] 

Substitute  (18)  and  (23)  into  (14)  we  obtain 

[[sj  ♦ [s2]  ♦ . . • ♦ [s  J • • [=„]]■ -1  [H  • [s2] ' • • • [Sil  • • • • W] 


< 0J>“ 


i=n 


E N 


i=l 


i=n 


-1 


£ H 

i=l 


-1 


[[Sl]'  [S2]  ' [S3] [Sn]] 


U) 


(24) 


since 


H 


Wi  = u»i 


Eauation  (24)  states  the  computed  angular  velocity,  <w>,  of  the 
instrument  cluster  based  on  outputs  of  the  individual  instruments 
In  this  equation  the  outputs  of  the  individual  instruments  are  so 
weighted  that  the  sum  of  the  squares  of  the  errors  associated 
with  all  the  instrument  axes  is  minimized. 
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Equation  (24)  is  a general  one  and  prior  to  its  solution,  instru- 
ment orientations  have  to  be  specified.  This  is  done  in  the 
following  paragraphs  for  tetrahedral  orientation. 

DESIGN  MATRIX  FOR  FOUR  GYROS 


Thus  let  us  assume  that  n - 4.  Using  Equation  (6) 


i-^  1=4 

e w ■ e 

i=l  i=l 


■ <H- 


*]  - w m 

S [KM], 


tion  ^25fValUate  the  value  of  the  suni  of  the  products  in  Equa- 


E W in]  - E 

1=1  1=1 


i=l 


s . 

XI 


yi 

s , 

Z1 


fs  . s . s , | 

L xi  yi  zij 


s2. 

XI 

s . 

XX 

s . 
yr 

s , 

XI 

s . 

Z1 

s . 
yi 

s . 

XI 

s2. 

yi 

syi 

S . 

Zl 

(26) 

s . 

Z1 

s 

XI 

s . 

Z1 

s . 
yi 

s2. 

ZX 
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Assuming  orientation  of  the  spin  axes  on  the  faces  of  a tetra 
hedron  as  shown  in  figure  F-2,  xt  may  be  proven  that  the  directxon 


cosines  for  the 


unit  vectors  are: 


Figure 


F-2.  Regular  Tetrahedron 
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for 


i = 1 s = — S=—  q 1 

xl  ' *'•>  — ' s 


yl  n/T'  21  sfj 


2 S 


x2 


- I s = 1 c 

y2  sz2 


1 


3 S 


x3 


vr  y3 


= - s 
^3 


z3 


1 


4 s=i  s = _ 1 s _ _ 1 

x4  VT  y4  24  - ^ 


i=4  i=4  i=4 

E 4 ■ I-  E & - f E 

1-1  i=l  i=l 


s2.  = 1 

zi  3 


i=4 


i=l 


S . S . 
xi  yi 


i=4 


i=l 


S . S . 

XX  21 


i=4 


i=l 


S . S . = 0 

yl  zl 
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(28) 


(29) 
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Substitute  (28)  and  (29)  into  (26)  we  obtain 


t PJ[gT] 


(30) 


Substitute  (30)  into  (25) 


£ m ■ *[■]-»[■]  ■ » [■] 


and 


£ 


(31) 


Substitute  (31)  into  (24) 

5 - I [ [8x]*  N'  [S3]'  M]  = 


(32) 
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Substitute  (12)  into  (32) 


8 [ [Sl]'  [S2] ' [S3]  ' [S4  ]J  l>l] 

[w2] 

[W3] 

.K] 

I [[Sl][“l]  + [S2]  [“2]  + [S3][“3]  + [S4][“4]  <33> 


But  since  in  general 


[si]  [“i]  - [-i] 


Then,  the  least  squares  solution  for  four  gyros  arranged  in 
tetrahedron  configuration  is  given  by  Equation  (35) 


<UJ>  1234  “ I [W1  + W2  + ^3  + "4]  ( 35 ) 


Where  u>1#  w2,  u>3  and  u4  are  vectors  representing  outputs  of  the 
four  gyros. 

The  subscript  1234  to <^>indicates  that  solution  is  based  on  the 
output  data  of  all  four  gyros. 

The  relationship  stated  by  Equation  (34)  may  be  derived  from 
physical  reasoning  as  follows:  Premultiplication  of  a vector  by 

the  matrix  [S^J  yields  the  component  of  that  vector  that  is  per 
pendicular  to  the.S^  vector.  Now,  since  Hj  - is  defined  as  being 
perpendicular  to^Si,  then  premultiplication  of  w.  by  the  matrix 
LsiJ  must  yield  1 
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DESIGN  MATRIX  FOR  THREE  GYROS 


Next  let  us  assume  that  n=3 . When  one  of  the  gyros  in  a tetra- 
heoral  set  fails,  then  we  wish  to  process  only  the  outputs  from 
the  remaining  three  properly  operating  gyros.  Let  us  make  an 
arbitrary  assumption  that  gyro  number  4 has  failed. 

The  sum  of  matrices  in  Equation  (24)  becomes 


£ M - M + M + M + M - M 


Note  that  the  matrix  involving  the  failed  gyro,  [^4]'  was  added 
and  subtracted  in  Equation  (36) . Substitute  (30a)  into  (36) 


Assume 

Thus 


t M = ft1]- 

i=l 

■(!  H 

that  the  inverse  of  Equation 


W 

- 1 N ) <37) 

(37)  is  given  by  Equation  (38) . 


1 — J 

2 


-1  -1 


(38) 
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The  relationship  stated  by  the  Equation  (38)  may  be  verified  by 
performing  multiplication  indicated  by  Equation  (39) 


£ m1  [£  m]  ' ■ w 

1-1  J L i=l  J 


Substitute  Equation  (37)  and  Equation  (38)  into  Equation  (39) 

rw-iw]  [r  [>j*»w] 

I 

= [j] + 1 M - 1 h]  - & [s4]2 

t1]  + 244015  [S4]  ' 40  [S4]2 


■ w 


Q.E.D. 


Where  it  was  noted  that  relationship  stated  by  Equation  (22) 
was  used. 

Substituting  (38)  into  (24)  and  noting  (34)  we  obtain 


8 [[J]  + 5 CS4  j]  [“*1  + -2  + w3  ] 
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liquation  (40)  states  the  least  squares  solution  for  the  tetra- 
hedral set  when  it  is  desired  to  process  the  data  from  gyros  1, 
2 and  3 and  disregard  the  data  provided  by  gyro  number  4.  In  a 
similar  manner  when  the  data  from  gyro  number  3 are  disregarded 

wo  obtain 


< u> 


124 


3 

8 


[X]  + t [S3 ] w!  + “2  + ^4 


(41) 


When 


the  data  from  gyro  number  2 are  disregarded  we  obtain 


< U)> 


134  8 


[l'HM]  h 


+ “3  + w4 


] 


(42) 


When  the  data  from  gyro  number  1 are  disregarded  we  obtain 


< Ul> 


234 


3 

8 


[H*!  I'll  ] [=>*=.*=<  ] 


(43) 


DESIGN  MATRIX  FOR  TWO  GYROS 


Finally  let  us  assume  that  n=2,  i.e.,  when  two  of  the  gyros  m a 
tetrahedral  set  fail,  then,  of  course,  we  wish  to  process  only 
the  outputs  from  the  remaining  two  properly  operating  gyros. 

As  before,  let  us  make  an  arbitrary  assumption  that  gyro  num- 
bers 3 and  4 have  failed. 

The  sum  of  matrices  in  Equation  (24)  becomes 


£ H • N * N 

i = l 
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Assume  that  the  inverse  of  Equation  (44)  is  given  by  Equation  (45) 


g Mj  = X [T  ] - f [[Si  J + [S2]]  + ^[[Sl]  + [S2]]2  («) 


As  before,  the  relationship  stated  by  Equation  (45)  will  be  veri- 
fied by  performing  the  following  evaluation. 

Define 

h ■ N+wr 

Substitute  from  Equation  (45) 


[B]  - V [*]  ' l[[Sl]  + [S2]j  + TeT  [[Sl  ] + fS2  ] ] 2 <47> 

Noting  relationship  expressed  by  Equation  (6)  we  obtain 

M = [x]  - [sn]  <4s> 

M = t1]  _ [S2zJ  <49) 
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Where 

[sn] 

N] 

Thus 

[N  + H]  ■ [2  W - M -.M] 

Also 

2 

[M-N]2  = [■  H - [K] + [*«]]] 

-[*] -[[■«]  *M  [2H 

- [ [sn]  + M]] 

- 4[J]  - 2[*]  [[Sll]  + [S22]] 

-[KbM]  *H  + [[-u] 

+ [S22]]  [[Sl1]  + [M] 

= 4[l]  - 4 [[su]  * [s22]]  +[Sn][SU] 

+ [Sll]  [S22]  + [S 2 2 ] [Sll]  + [S22]  [S22l] 

(53) 


A 

= si 

AT 

si 

(50) 

= s. 

at 

So 

(51) 
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Evaluate 


[Sll]  [Sll]  [Sll] 


Substitute  Equation  (50)  into  (54) 


hJ  hi]  - si  k % 


A at 

- S1 S1 


■ hi] 


AT  A 


Because  Sj_  is  the  dot  product  of  the  same  vector  and  this 
equal  to  unity. 


Similarly 


[S22]  (h]  [S22] 


Next  evaluate  [sj  [s22J 
Substituting  from  Equation  (50)  and  (51) 

hi]  h2  ] - ®x  K n 


= I c 

3 bl  b2 


4 1 

3 


[■..] 
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(54) 

is 


(55) 


(56) 


I 
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Because  §2  is  the  dot  product  of  two  unit  vectors  and  for  the 
case  of  tetrahedron  orientation  this  dot  product  is  equal  to 
- 1/3. 

Similarly 


[^22 ] [Sll]  3 S2  S1 

= - 3 [S2l]  (57> 

Substitute  Equations  (54),  (55),  (56)  and  (57)  into  (53)  obtaining 

[[si]+  M] 2 = 4 11]  - 4 [ [sn] + W] 

+ [Sll]  " 1 [S12]  " I [S 2 1]  + [ S 2 2] 

= 4 [i]  - 3 [[Sn]  + [s22]  ] " T [[S12] 

+ [S2l]  ] <58) 
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Substitute  Equation  (52)  and  (58)  into  (47) 


H • t W - ! [*  [■]  - [.u]  - [.„]] 


•*[*[■]-■  [hj  • W]  -J[[*„]  * [>„]]] 
*1]  H * (Mil  [[■„]* Ml 


3 

16 


[[S12]  + [S2l]] 


(59) 


Noting  definition  of  [b]  from  Equation  (46) 
of  Equation  (59)  by  the  inverse  of  [b]. 


multiply  both  sides 


w -{§w 

* A [hi]  * hi]] 

- *[[■..]  • [■1,]]}f  [.]-[[•„]  * [•„]]} 

- M-i [hi]  * hj] 

+ 8 [[Sll]  + [S2l]]"  A [[Sll]  ' [««]] 

- i [K]  * [■„]]•*  [hJ  * h ,]][[-,  j • h j] 
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-[’]♦[-*♦  I]  [KJ  + [»»]] 

-&[M  + N]2 
- 1 [M + M] 

+ 16  [ [S 1 2]  [Sll]  + [S12]  [S22]  + [S2l]  [Sll]  + [S2l]  [S22]](60) 


Evaluate  components  of  the  last  term  of  equation  (60)  using 
definitions  stated  by  Eqs . (50),  (51),  (56)  and  (57) 


Hfii]  - MSMI  - 

■ 3 [Eu] 

(61) 

NM  - ■ 

N 

(62) 

hj  hi]  - MM  - 

(63) 

[=2l][S22]  - Mft  - 

“ 1 [ s 22] 

(64) 

Evaluate  the  term 

[M  + [S22]]2  = [[Sn]  + [S22]][[Sn]  + [S22]] 

* [Sll]2  +[Sll][S22]  + [S22][Sll]  + [S22]2 


- hi]  + [S22]  - I [[S12]  + [S2l]]  <65> 
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Substitute  Eqs.  (61),  (62),  (63),  (64)  and  (65)  into  (60). 

H ' [rJ+ I [[sn]  + [s22]] 

- ll[[sii]  + [s22]  - I [[s12]  + [s21]]j 

- * [[•»] + [•»]] 

+ ^ [hJ  + [S2l]  - 1 [[Sll]  + [S22|] 

= [JJ  + [f  - - ife]  [[SllJ[S22]] 

+ [A  - I + li]  [[Sl2]  + [s21]] 

= [i]  Q.E.D. 


Table  F-l  shows  the  design  equations  to  be  used  for  the  special 
gyro  failures.  Note  that  the  matrices  [Sx  [s2],  [s3]*and  [s4l 
are  only  dependent  upon  the  specific  orientation  of  the  tetra- 
hedron relative  to  the  reference  coordinate  axes  selected  and  are 

JlT  independent  of  the  orientation  of  the  gyro  sensing  axes. 

The  iUI1  matrix  is  given  by 


where  i 


= 1, 


\l  - s2.  i 

XI 

1 

1 

-s  .S  . I 

xi  yi  j 
1 

*■ 

-S  .S  . 

XI  Zl 

-S  . S . I 
xi  yi  j 

| 

1 - s2. 
yi  | 

j 

-S  . S 
yi  zi 

-s  .s  . J 
X1  21  1 

-s  s . ' 

XI  Zl  j 

1 - S2. 

ZlJ 

2,  3,  4. 
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Table  F-I.  Design  Equations 


GYRO 

FAILED 

DESIGN  EQUATION  TO  BE  USED 

NONE 

:u)>1234  8 (W1 

+ ZJ2  + -3  + -J 

1 

e'J>234  - UW 

+ 1 [Sl]XS2  + ^3  + “4) 

2 

<<J>134  = 8 (t1] 

+ t [S  2]) (^1  + “3  + "4) 

3 

<w>i24  = |([i] 

+ 5 [^(“l  + “2  + 0 

4 

— >123  = |([l] 

+ I [S4])(“l  + =2  + =3) 

1 & 2 

(^[l] 

^U>3  + UJ 

■ 1 [M  + H]*  16  [[S3]  + N])2 

4) 

1 & 3 

<u>24-  (tH 
(52  + = 

4) 

1 & 4 

<u)>23  = [l  j 

(“2  + " 

1 - ! [[s=]  + [sa]]  + & [h]  + [s3]]) 
3) 
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APPENDIX  G 


RELIABILITY  DATA 


403314 


RELIABILITY  DATA 

Attached  are  two  separate  reliability  predictions,  of  18 
pages  each,  for  the  redundant  strapdown  INS.  Both  predictions  are 
based  upon  MIL-HDBK-2 1 7B  failure  rates.  The  first  assumes  an  Air- 
borne Inhabited  application  with  the  part  ambient  temperatures 
stabilized  at  a maximum  of  70 °C.  The  second  prediction  assumes 
an  Airborne  Uninhabited  application  with  a part  case  temperature 
of  9 0 °C. 

The  Airborne  Uninhabited  prediction  is  applicable  to  mili- 
tary aircraft  applications  and  is,  therefore,  conservative  for 
the  VTOL  application.  The  Airborne  Inhabited  condition  is  appli- 
cable to  Commercial  Airline  installations  for  inertial  systems. 
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CCK*) 

Oapicvtov,  , So  It  A. 

Ccs  TO 

C*vt**crbov 

INDIVIDUAL 
FAILURE  RATE 

00 

TOTAL  PAILURE 
RATE 

<*1XJ 

o.ouS 

0 .3^5 

O.oio 

0 -3  So 

o.ouo 

o .V>0 

0.0T<1 

0.8I.H 

0*010 

o -Ho 

o.on°i 

0. 31  <» 

C * 

0.0*11 

0 -0 

0 ,00.5 

l.obS- 

2.*o34 

ASSEMBLY  FAILURE  RATE FAILURES/106  HOURS 

G-12  ASSEMBLY  MTBF 2Z3,  0 HOURS 


RELIABILITY  PREDICTION  DATA  SHEET 

Ak  1VBORNC  XNHA-MTITt 


DATE:  ASSY  AMBIENT  TEMP:  *C  SHEET  — 1 OP  — L 

PROGRAM:  Nw.  a!t,y.  ~Z/o  i H«  • [ _ 

NHA:  SCHEMATIC  NO:  


OU  ANT 

n> 

PART  TYRE/ ASSEMBLY 

stress 

ratio 

INDIVIDUAL 
FAILURE  RATE 

00 

total  failure 
RATE 

F|A) 

wa 

T.C.,  TRoH  CA  «S3®<0 

— 

O.5Z0 

k i 040 

wa 

T.c,  ssx/hji  Can 

— 

o.  0 4? 

0 .0^0 

a 

T,C.#  SSX^H  SX  l (jyS&Siofo o\0  4^ 

— 

OlOUy 

0,1 3o 

gg 

T.C.  SSt/AiX  ^^--t-4.1  03#Sl*/oo4*0  C»NS4  0l) 

— 

0,01* 

0 .140 

a 

X.C.(SSI/msX  CM38Jio/«  CsN-PTiia} 

— 

0.611 

0 .V58 

X.L.  sst /Hsa  D^.ti.1  CA3esi»/oi3ofc)  Csns-^ilO 

— 

o.  l S k 

0,  U 0 ^ 

8 

— 

0.148 

1.184 

3 

x.cnsix/mi  "kij-tAi  Cs<i54isi»0 

- 

o .oil 

6. 131 

B9 

T.C.,  SSt/HSl  C3«S‘4S?.S"0 

- 

o .i*  S' 

0.U3O 

Is 

7.C.,  SST/rtsZ  Lwtii-  (MSSElo/  Cl-*****} 

— 

0.184 

9.3U2. 

8 

C>pxcv'torj  G»rv<AHt.  CCK^) 

0,0 

O.olt 

z 

C-ipitv tft y Si\^i  0**0 

ns 

o»oo  + 

o*oo  & 

s 

0*60  4- 

o . o 8o 

is'to  T-  C-^v\|*ys  Ovv>p  iJi  \tl*  v>  QK,CTC) 

1 

0.60  k 

o .o4-* 

» 

— 

2,04 

2..03* 

s 

S 

• 

ASSEMBLY  FAILURE  RATE 


u . ao°i 


FAILURES/  10*  HOURS 


PAGE 
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OF 


16 


G- 


ASSEMBLY  MTBF 


v A(#, 


HOURS 


RELIABILITY  PREDICTION  DATA  SHEET 

a\R*»orns.  TMHfcfcrrsa 


W»  v^Vtv 


— ASSY  AMBIENT  TEMP: 
N^V,  agcv 


*C  SHEET 

T/0  N..2L 


OU  AN  T 

<n» 


PART  TYPE/ ASSEMBLY 


BE 


*?Rok 


T.C-t  SST/MJT  0v39SiyOQId4) 


X>C,UX/MSt  C^3S5lt|Oo4oi') 


*r.C.(SST/*«t  («3eSio/*ij.ol} 


T.C.,Ssx/Ax*  iMj.tvl  C*3e5lo/oi3oU> 


x.c.,ssr/Ktx  xi^.ti.1  C^Jeyto/  0*so i) 


T.c.,  ssrc/fxix  oholj 

IJL  I T.C.,S5l/>«rl)lvt>l 


T.C.,  SS*C/HIX  fetoi*) 


OaPXci^Y,  "X^y-a^iC- 


pfvcv'tfr  *,  , S»  u4 


-koit^lav  


•4  ''tl®  yy 


SCHEMATIC  NO: 


Cmm  J3*o) 


Cam  1500) 


Csn5A»o) 


C SHS-*»0 


C-*M54lt3^ 


C SrtS+lfaO 


CSN  S*  l<»4-") 


CsMS4fcS  HJ-) 


CsriWtyj) 


C L-rt‘',wN 


UKl"i 


C«K) 


Oltc 


CRc^ 


ITRflS 

RATIO 


INDIVIDUAL 
FAILURE  RATE 

<X> 


O.S’Xo 


O.ots 


o .olo 


0.0H 


o.l  S* 


0. 1*8 


CMOS' 


o -18  I 


o.oo<\ 


o .00  *■ 


0.00  4- 


0 .00  l 


J OF 


total  failure 
RATE 

nX) 


O„S2.0 


o.o^S 


o.rwo 


».T$0 


0 OT.t\ 


o-  So?., 


0,S\1 


O.A-V  4- 


i.ruo 


0.18  I 


oolv 


0008 


0.080 


o >o4o 


X.0S4- 


RELIABILITY  PREDICTION  DATA  SHEET 

M ft%0  UNE  TNH*»VTe» 


OATE:  ASSY  AMBIENT  TEMP:  ~t° *C  SHEET  i — OF 

PROGRAM:  1 tt »V.  4„v.  T<0  Kft  .3  

NHA: SCHEMATIC  NO: 


OUAMT 

<n» 

PART  TYPE/ ASSEMBLY 

STRESS 

RATIO 

IMOIVIOUAL 
PAILURE  RATI 

00 

TOTAL  PAILURE 
RATI 

z 

T.C^  102V8»V?R0P\  Qn.MSwj  *oi«4-) 

— 

o.SZO 

1.040 

wm 

T.C.,  5ST/»iS'E'3ifc.'t.i\  £m38Sio/ooi*V)  C.SHJ4*o) 

— 

O.  OOS 

O.lio 

ma 

Xc.,SST/*3X  C^38Sio/ 0*105)  C 3rlS4*4} 

— 

0 , oTO 

n 

-r.  c.ssxyMsx'bi^.tn  C*J8S‘io/**ioj)  CinsHio) 

— 

0 * QUO 

o oUo 

m 

•S.C-,SSSij^AX1>'£t^  (NJant/pololO  C>f134Z0 

— 

o 0S3 

0153 

-r.c(  ssi/^s-c 'bvs.tii  CMi8-Sio/o ijivj  Ois+iw} 

— 

0-148 

0,88* 

“C.C.,  Ss-c/HSH.  (/«  JS-Slo/ooSOI-)  CaM54lUS) 

- 

o aSi 

0.U04 



3 

T.c.(  ssr/Msr  C*38Sio/oiio2j  Csns^lsul) 

— 

O .OT  8 

* LST 

\ 

X.C-(SST/nst  tinny  [ns%si*j  io»»0  omi) 

« 

o.lftl 

0.181 

8 

Ctr-a^vc  CCK^C) 

D.QOS 

o*o“U, 

2- 

C*ra«.vt*Tj  ,T»w4-.  S»l\A  CwO 

ess 

0*0  0 4* 

Ml 

\ 

C o v> ^ Q."to  V t *TO  n^sTPv 

— 

•2.o^R- 

*.o34 

\s 

na 

O'OOV 

o«ow* 

■9 

BM 

o *o«  v 

*■005“ 

. 

1 1 

1 

ASSEMBLY  FAILURE  RATE  FAILURES/ 10*  HOURS 

^ *1  HOURS  PAGE 


OF 


ie 


G-l 


ASSEMBLY  MTBF 


HOURS 


RELIABILITY  PREDICTION  DATA  SHEET 

AHVaoS-Htt  TNHAX'Ttt© 

OATE:  ASSY  AMBIENT  TEMP:  1°  *C  SHEET 

PROGRAM:  ,««v.  ^,jt  C~a<  j 


PROGRAM 
NHA:  


QUANT 

<n> 


SCHEMATIC  NO: 


PART  TTPE/ASSEHRLY 


STRESS 

RATIO 


T.C.,  sw/n« 

(.C*  4053} 

X-Cs  Ssi/mit 

CAH  150©) 

T%  c.,  Sst/HST  1 

V.SNS41-SSO) 

I.C-,  S&T/A4JI 

TZC.,SSX  /MSI 

C*«S4iU4> 

X.  C^SST^SX  D,%Xx\  QnteSH/ol'ltl') 

C3154K.*) 

CA3  8Slo/oot«L^  Cs  N ;s*“ll 


T.C.,SST/m5-c  >'S'tiv  Crt-«S i«/o»loS) 

C SN5404--) 

T.CjSSX/MiT  (>13$.£|o/ooioJl} 

C*1  S4X©] 

^•C~-  SVt/MsTI  (/l3SSIo/oi3»tQ  £sr*  SH-lCl' 


T.C.,  S Liwrav-  (%a335Io/(oio  i\  £>ni*l) 


"gC.,  S L.vra^ Qi_M  Ujl^ 


T.C.,  SSXjHriL  Ltwrx^ 


T.C..  gST/ns  H Cl-^'^O 


Tv^MSIsto^.  Npfj,  U'V'Ctr  CXAHTX^ 


TV>»S»S^>Y,  TK?,  l.Mqy  C'TANTA-) 


CXANTx} 


"bioit,  frtutrsl  "YuT-OAH. 


picvto^  S*\\4 

Cc.  szl 

C ov-j  fA't'fc'i  V i it  4 

Cch  a") 

?>«VS  ^O-r  "Fk  Vm 

OlV) 

wWr  T\  \ m 

0*0 

*P©tS  lt‘V*Yi  ^ Tawtv* 

C***) 

^Rct  i*To>p>  uj  . w.  fcc twn^ 

Ck**) 

1 fcA  \ * V\v i-x'ko \t 

Crnc^ 

Tvv  iut^1  T » vutv^ 

OstiUv¥*v 

C«MW\«CX.UV|  <^0  T»»n 


ASSEMBLY  FAILURE  RATE  ^>U>0  FAILURES/ 10*  HOURS 


INDIVIDUAL 
FAILURE  RATE 
(\) 


O,  VUV 


©.  0*5 


9 .0*5 


0.01 


0.\4& 


0,151 


© ,©61 


o.«lo 


o.oSi 


0.151 


0'i  6 l 


o.W 


0.Z54 


o .Lo& 


0.  040 


O.oSI 


o.5UO 


o.o  S3 


tr-OO* 


6-0*1 


0.0 1 i 


0-07*0 


0-03L 


o ©S4 


o ©54 


*©o 


Z.  034- 


total  failure 
rate 

(nX) 


©.l«.L 


©.©45 


o .o*S 


o«1S 


o-l4l 


0-^0  Z 


© 546 


©•X8o 


0-0  55 


0 -°|©U 


0 3I.I 


o.uei 


o.l  wz 


o.Zoft 


o-u*o 


a -oS0! 


o - 3to 


0.4H 


o.  IS3 


0-0 IL 


e>  «©Z 


0.100 


0 .oZo 


o -oZZ 


« ,5o* 


o -03Z 


o .05*- 


1 .000 


Z-034* 


G-16  ASSEMBLY  MTBF 


tOS.ALO 


HOUR5 


PAGE 


OF 


RELIABILITY  PREDICTION  DATA  SHEET 

XMHA'ftrnM 


OATE:  ASSY  AMBIENT  TEMP: 

PROGRAM:  ASSY: 

NHA:  


~lO  *C 


SHEET  ! OF 


Tou.t'T  Sw»1n  AasfcwnWh 


SCHEMATIC  HO: 


ASSEMBLY  FAILURE  RATE 
ASSEMBLY  MTBF 


^ -^3  FAILURES/106  HOURS 
* 1 1 i ^ ^ ^ HOURS  PAGE  * — OF  J £ ^ ^ 


RELIABILITY  PREDICTION  DATA  SHEET 

MWfconrHK  T:nH*»vrta> 


°ATE:  — — ASSY  AMBIENT  TEMP:  *C 

PROGRAM:  £4vipA»wv>  Tntvt.\xl  May  T*wt-rS»ffW  Ca*-A 


SHEET 


SCHEMATIC  NO: 


Quant 

<n> 


PART  TYPE/ASSEMBLY 


STREJJ 

RATIO 


T.C^  SST/mS!  Lvx  t*iv- 


X.c .^Ssx/nsx  Ltnexv- 


:^C  S$Tl*\sT 

H 1 hPH,  U\v>«ar 


5\sX f TlHP, 


l 2.  it  ^ "Parpost 


'bioit.  *Ltv>  tr 


13  "t>  »o  Ac  ec“t  t -f  Vt>r 


\ 0 C-» p 5o\\4 


Ca y ~~Fa «■> » V ih)^c 
3i  I "Fi\v7\ 

T'>Tnst8vl  "F.li-n 


*\C*Wt  poi'tio^ 


CtHtos) 


Cum  »*0 


Cum  ii«0 


C«TC) 


C<-*S) 

CtHjg 


C^LWO 


CKHC) 


CRclO 


■ S^  Oy( 

'N.W.,?«Wtr 

CTLW  £) 

LT't  f 

Cv.ttC> 

C*  \ \ 

, *^OUj 

tv- 

Tn 

l n S >r  rv\  C w e V- 

C*v% 

v 3oT,w 

INDIVIDUAL 
PAILURE  RATE 

00 


O .m 


o .Lo8 


o ,lo8 


0.  04-t 


o.oS^ 


b.oS3 


o.  as 


0.6 


0 .004- 


0-00^ 


0 >00  l 


o o«  ^ 


ffoo4- 


o-oo  { 


0 .0  U 


0-631 


0-05* 


<j-oS* 


o.SZB 


TOTAL  PAILURE 
RATE 

<»A) 


o-  in 


Q.7.08 


o .^14- 


o.WU 


0-U3C 


o.l^o 


won 


9 OAo 


o.iSl 


0 ,60V 


O.lll 


0 00  4- 


9 -0  lu 


0 ^88 


0 031 


o.lo8 


0 Si8 
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G-18  ASSEMBLY  MTBF 


> <*\  m- 


HOURS 
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RELIABILITY  PREDICTION  DATA  SHEET 

M'R'boRns  -TnHAOVTRS 

DATE:  ASSY  AMBIENT  TEMP:  35 — *C  SHEET 

PROGRAM:  S^Rf  _ As$y.  + S ^ ^ Sv.yfV^  


PROGRAM: 

NHA: 


SCHEMATIC  NO: 


OUANT 

I'll 


f ART  T YPE/AJ$EMtL Y 


JTREJS 

RATIO 


I I T.C.  SST/MSX  L>**iv 


TVa^sis’ta-'  L 


"TV'** S o < T*N V ^ Lwir'a.v- 


C*3lp'aci't  4/  + . £*\\4 


’'tyiWNvC 


Cun  * on-) 


CcstC) 


Cck«-) 


3 

S * 3^ * * , f * \ m 

CUCO 

8 

~RcSlst*v  C*3v^*v%  C-aw^p  c J it  it  v\ 

CkcV) 

INDIVIDUAL  I TOTAL  FAILURE 
FAILURE  RATI 

(XJ 


6 . US’ 


«o  SA 


O.DO^ 


« .oo  V 


0.00  V 


ASSEMBLY 

FAILURE  RATE  _ 

o ,2>°i4 

_ FAILURES/ 10*  HOURS 

•2 , 

si®  .on  i 

ASSEMBLY 

MTRF 

**  / 

_ HOURS 

PAGE 

RELIABILITY  PREDICTION  DATA  SHEET 

MR'BOfcHS  THrtKBVTIED 


OATE:  ASSY  AMBIENT  TEMP: 

PROGRAM:  T^ty-Liil  ASSy. 


QUANT 


-7°  - #C  SHEET  L 

V\^V>  VoVhzfoe. 

- SCHEMATIC  NO:  


R ART  TYRE/ ASSEMBLY 

T.c.,  SST/ ^Vsi  U«rw 

C l.  M t Jt>) 

Tr-i^sk.s'tov,  NPN  (L»«e^v 

'Tit'Awsvj-Lov,  TKP.Uvst'iV' 

stress 

RATIO 


"bio  It. 


8 | t ^tor,  Cev^ao^uc. 

*~Mnj  C*xrW*^a^A. 


12.  Tesistor  \-s\yy\ 


P>t5  U^o>rt  W Vv/.  To  \jj  t v* 


2>  | Cov\  ."PywLy 


CoV\»'RCt«'r  ioT'^vv 


Ccx.RT 

Cc-hTC) 


ev-wv) 


c 


Crw*^ 


INDIVIDUAL 
FAILURE  RATE 

00 


0.33® 


0-0  ‘Vo 


o.OS^ 


O.OS3 


O.OT^ 


9 .qOA- 


0 00 


0*001 


0 -0»  t 


o o it 


0-05-V 


o.or* 


o .38^- 


TOTAL  FAILURE 
RATE 

<nxj 


o.  338 


o.A4o 


0.0S<\ 


o.S3° 


0.S-1A- 


o .olo 


5.01?; 


O OO  t 


o .0^-8 


o.o?^r 


O ■0+  + 


o.lfcL 


0.  toft 


0*38* 


RELIABILITY  PREDICTION  DATA  SHEET 

AJR'BORnK  ONirs  ‘TED 

DATE:  ASSY  AMBIENT  TEMP:  15 *C  SHEET  [ — OF 

PROGRAM:  Hav,  my  SVrt^,w>>  HjvlS^t,r 

NHA:  SCHEMATIC  NO:  — 


ASSEMBLY  FAILURE  RATE ZO  H.  FAILURES/106  HOURS 

I | ^ 

ASSEMBLY  MTBF HOURS  PAGE  OF  


RELIABILITY  PREDICTION  DATA  SHEET 

Alfc'bORMG.  OH1N  ttH&'&lTKTD 


DATE:  ASSY  AMBIENT  TEMP: 

PROGRAM:  5~^f Hi*  A).<v. 

NHA:  


_J12__#C  SHEET  __L_ OF 


SCHEMATIC  NO: 


QUANT 

<n> 


PART  TYPE/A$SE*»LY 


3Tv\  s4^ru  vn  t ^bl&eK  \o^n 


Vj'i.W  *ca.  Cav-A 


T M ri  T(0  C-a-^A 


CTU  Ci>rl  Ti«,  \ 


C?U  C-».v4N<j.L 


S«t 

T»vt 


T«wrr  S. 


INDIVIDUAL 
FAILURE  RATE 

(X) 


V Z s. 


33.551* 


xs.Tn 


IS. (.35 


3"l*LJ 


ft  l .fc«L 


4-S.34-0 


total  failure 
rate 


(ZS.uSS 


3 3 -S5» 


22.^11 


It  -(.3S 


3*1.4i6 


4S-34o 


n 

""Po^rt  Ls^lC.  C'lvi 

10 

1 1 1 63  i 

U<J3i 

i 

“I!  1 o CxwA-  No*  1 

1 \ 

n-oit 

n .q*il 

i 

1/0  Ca^i  N*.L 

i £• 

l 5.5*1 

■i 

‘X/o  C av-i  No.  b 

13 

is.iei 

i5-(Sl 

n 

K « It.  C**-^ X 

BBM 

2.3.S4S 

2b.  9\5 

ASSEMBLY  FAILURE  RATE  -504.3  U.  FAILURES/ 10®  HOURS 
G-22  ASSEMBLY  MTBF ^ HOURS 


PAGE 


DATE:  

PROGRAM: 
NHA:  


RELIABILITY  PREDICTION  DATA  SHEET 

AlKBORHC  uhiihH  A"biTEJ> 

ASSY  AMBIENT  TEMP:  ^ ° *C  SHEET  — ! OF 

ftWwTwf-rtwi  K^v,  ^SSY  ‘ "bUo* 


SCHEMATIC  NO: 


QUANT 

<n> 


PART  TYPE/ ASS  CM  ALT 


G't  ro^^ofc  , Q - 


Actt Vt"^» . /\*\ooo 


I.C.  WnV>wl  (W,%Uu.»(^S-.^ 


SSTjmsi: 


STRESS 

RATIO 


(.188044) 


Cum  \ 3«0 


1.  C.t  Si-C/Mrx  Cmissio/ooio^ 

CSNS480^ 

X.C.,  SVijMSI  C'3aSlo/oo8o‘N) 

GSN-S4-0(,} 

T\*vA. 


C«V) 


■a 

(rW$$ 

'TruAVis'^*^,  N?H, 

CtahtC) 

n 

'bifcAt,  Cr*  vse/a  ^ * 

2.8 

S V J Tr  x \ YVN 

CfcUO 

14- 

C-xv-Wi#^  C* v%NpaSiti«vi 

Cucv-T 

MW 

Co  vrv\e  tir  4 (*o  T * ✓v 

INDIVIDUAL 
FAILURE  RATE 

<\) 


35.«#o 


V(..l3b 


\Z.  3o5 


0.48Z 


o.  io3 


o .ll°| 


O.oZZ 


o.olu 


0 .Oil 


o.  on  °| 


0. 120 


«.  0 10 


o.oo.g' 


4 .34<\ 


total  failure 

RATE 


38.410 


48.22,0 


0 ,°l  U4 


o .2.0  L 


0.2.38 


o.l32. 


0.104. 


0 . \44 


0.84-3 


0.480 


0,2,80 


o old 


4-344 


DATE: 


RELIABILITY  PREDICTION  DATA  SHEET 

Ai'R'BoHmE.  onin rt A"Binz-l> 

ASSY  AMBIENT  TEMP:  q 0 *C 


SHEET 


PROGRAM:  5t<-apl»>jiv,Tw«v-Vvi|  N->y.4<<v,  Ti»>4yuiwe.wi‘  Cavj 


SCHEMATIC  NO: 


PART  TYPE/ ASSEMBLY 


STRESS 

RATIO 


INDIVIDUAL 
FAILURE  RATE 

00 


TOTAL  FAILURE 

rate 

01)0 


ASSEMBLY  FAILURE  RATE  -33*55*1.  FAILURES/ 106  HOURS 


G-24  ASSEMDLY  MTBF 


2*\,  80  | 


HOURS 


PAGE  — OF  ii. 


I 


RELIABILITY  PREDICTION  DATA  SHEET 

AiRBORWC  UNIWMfr&nED 

DATE:  ASSY  AMBIENT  TEMP:  fl 0 *C  SHEET  — \ OF  _1 

PROGRAM:  Tnt>.Lul  Nlv.  tttv.  X tip  C.-a.yA 

HHA:  SCHEMATIC  NO:  . 


QUANT 

FART  TYPE/ ASSEMBLY 

STRESS 

RATIO 

INDIVIDUAL 
FAILURE  RATE 

total  failure 
RATE 

<T\) 

■9 

T.c..,  ssi/msi  T>i?.,Lm  C2-S°0 

— 

O.  33C. 

1 .344 

In 

x*c,#  c.'VTn-t-  Cz~?so£ 

— 

o.44l 

l .168 

\ 

T.C.,  CM3eSlo/ooloV)  CS*^00) 

■ 

c . t»3 

o,  |o3 

V 

X*  C f Ssl/H  SH  C.H  3£$“10/  0040?)  CSNS^oSl) 

— 

O.lli 

0 . u • 

K9 

X c.  “ii'i-tvl  CM3e^io/ootos)  ($^5404^ 

— 

0.1  II 

$.444 

n 

X.C.SST/nji  CHj9£io|ooXo‘?')  (SN54T4) 

— 

0,  IXL 

n 

Xc.(  SSV-lHSX.  CS*-54\Xs} 

— 

0,  i3°l 

0.133 

n 

x,c.(  ssr/nsx  tu  ^sn^isi) 

— 

0 ,Zoi 

0 .Xol 

; 

1 

T.c.^  ssr/nsi  (/\3ftsio/o  130O  (smsa-iwO 

— 

0 ,*4U 

0.14<* 

A* 

T.C.,  Ssi/nsi 

— 

O.S'U. 

l 

x,c.(ssK/n5i1»ij»txi 

— 

6 .ill* 

O.lTG 

l 

x.t.,  isi/itfi  Xn^.ti.1  CsMS-^siet^ 

— 

0.163 

0.183 

m 

X.C.sS  X|HS1  CSNS-4Sl?l) 

— 

0 . IT  6 

o.35(. 

l 

T.C.SST/'HSX  (SNSALSIIS^ 

— 

O.IU 

o.vuo 

2 

T.C^  SST/MSH  Xij.tvl  (.SN^ALSnV) 

- 

0 ,llu 

0.32*0 

l 

X.C.  SS X/M5X  V^4-) 

— 

0.7.4C 

0 .2.4(0 

\ 

T.C.,  SSX/nsx  X.j.tvl  ChT-'ToRA') 

— 

0. 1 L.0 

0 , \-t> 

i 

A/^  C*RV(y*  ^tv  MoAi/lt 

— 

lo.uai 

10.S.&L 

IL 

0 V*  t C t r Xu*  « C.  C.CK^") 

0.4- 

« .02^ 

0.351 

‘a.cv't.ov^  (^CS  5l") 

0.4 

0 .01.U 

0.104 

l 

Co*  V*  So  ^ 

— 

T.8AO  1 

1>84« 

1 

1 

ASSEMBLY  FAILURE  RATE  3.  5.^11  FAILURES/10*  HOURS 

ASSEMBLY  MTBF 3 8,  A-°tU HOURS  PAGE  €.  OF 


reliability  prediction  data  sheet 

Ai'RXo'RnE  UNINHABITED 


DATE:  : ASSY  AMBIENT  TEMP: 

PROGRAM:  ^>*1  Sfrrxf  .e<rY. 


*C  SHEET  _ 

Spi*»  / Cari 


NHA:  . 


QUANT 

<n> 


SCHEMATIC  NO: 


FART  TTFE/AJSENRLV 

T.C.,  SSX/MSI  Cni»S.o(oSo«0 

CC'i+Oll') 

I.C.,  ssx/«si  ^39510/05  ioz) 

CcfcAoL'O 

X.C^  SSX,H5T  3)i§«til  Q 

CO40  Zl) 

xc .#S3X,/mx  (^n3asio/o  »3ou) 

0'1S4-  iu0 

T.C.SSl/Hrc 

C>«  10«VS} 

T.C.,  SSX/MSX  T>  l 

CSHSALSUL) 

T.C.j  C^3£Su^oaio+) 

Cs»i^4oo^ 

t.c.,sst/n sxd Cn33Sio/oaw 9) 

CSNi404-'> 

T.C.^SVc/nSX.  7>i£vta.i  (/139SIO/OOI02) 

CS«-54m) 

T.C^SSI/msx.  'bi^ftx'v  C^33  Sia/oo<ioi) 

CSN^-^Sj) 

‘XrC.>SS2  /m3£  CH-S5Lo/o  14-0  3) 

CsN-SAlSj) 

x.c.^  SSX/MSX  (>l39S,o/  01304.") 

LSM  S4IW) 

T,C.  SSXfHSX.  Wives.*- 
9 * 

CHIOS') 

X.c.,ssT/Msr,  u» 

Cl«  ax’) 

T£.  SSX/'MXr  Uiwr-iv 

' * 1 _ 

0-F1 1 31-) 

\3^0'rl  HPK  , Lo  ^ »c  Svw  \+t-k 

C tan  til) 

N*N, 

CXanta) 

Tr^s 

CTANTjO 

GtAtrll 

Ctanv-jO 

SC.K 

CJANTjL) 

JT«e« 

RATIO 


INDIVIDUAL 
FAILURE  RATE 


O . 


0.313 


0-330 


0-Z4U 


O . I l«^ 


o.  tic. 


o>|f3 


0.  m 


o.oez 


O.W4 


04  50 


O.JWq 


O .33s 


o .333 


o.48l 


o .on 


o.ano 


o.t3o 


O.lZO 


0.Z44. 


0.0U 


total  failure 
rate 

nv) 


0.08  <> 


0 .330 


0 .13  8 


0 LSI 


o.lou  • 


o.ZU 


0.08Z 


o.i5o 


l .Z3o 


o 3°lS 


o-533 


0.4-az 


0.031 


0.414 


0. 130 


0.31,0 


X.qzS 


o.nu 


-5 

wt  0 Y(  ft  \ id 

Ccsiw) 

IBB 

o.oZw 

0.1^0 

3o 

~F*e*S  K S*^CY  \ n-1 

HB 

0 . 010 

0.30  0 

1 

t,stS"t“ovj  '^•W.j'Tguj «y* 

C^WTC) 

0.2, 

O.OZu 

0 .OUp 

l 

Cov\*\ct^.ov  qofT>  iv\ 

— 

1.840 

1.840 

ASSEMBLY  FAILURE  RATE  FAILURES/ 10s  HOURS 

G-26  ASSEMBLY  MTBF 53,117, HOURS 


RELIABILITY  PREDICTION  DATA  SHEET 

Al'R'fcOfcriG  uni  n»#B  iTEJ> 

DATE:  ASSY  AMBIENT  TEMP:  *C 

■Pfir.BtM  ASSY,  C.mp»t*r7T»C«SST:r_ 

MHA  — SCHEMATIC  NO: 


SHEET  _J OP  1 

C.'a'r  4 N 4 * ( 


OU  ANT 

<1> 

FART  TYFE/AJSENSLY 

STRESS 

RATIO 

INDIVIDUAL 
FAILURE  RATE 

(X) 

total  failure 
rate 

FIX) 

2 

T,C.#  LSI  ”*i%,tal  O*  itBS") 

- 

l - “I  -S 

■SllBH 

u 

T . C. i LSI  Cahls*0 

- 

3.3&4 

12..  S“iU 

T.c^  SST/n  si 

— 

O. 

0.  n«i 

rr 

1 C.  ioz4l.il  "Ron  (A^rni'i 

— 

I.31Z 

4 .1.04 

a 

X.C.  5ST /M  ST  ^ Ol33Sio/o  loaO)  C^-S^V) 

— 

o.ni 

O .HU 

x.c^  ssi/mst C^^asio/onoZ)  (_sn.T4  ns) 

— 

0-  Ml 

o-Sl!> 

3 

X.C.,SSI /«SX  Crt  3 8 S 10/00103) 

“ 

0. 144. 

0 432, 

T.CSSI/M51  I'V'til  C*NS+>-S'S3> 

— 

o.nu 

o.-bSZ 

IL 

C*p*a  cl*^,  or  t C*n***c-  CCKfl-T) 

O*  + 

0.61,1 

o.3SZ 

A- 

O^Tj  So  A ^0 

0 >4- 

0 iOZU 

0.104> 

4- 

EES 

0, 00  s 

0 Olo 

l 

Co  ct  or  ^ 0 ? m 

— 

1.6  4-0 

• 

j 

ASSEMBLY  FAILURE  RATE 


_ FAILURES/  106  HOURS 


U,1^5 


PACE 


OF 


G-2 


ASSEMBLY  MTBF 


HOURS 


ll 


reliability  prediction  data  sheet 

A I'R'b  o OMI  KH  A'fciTS.D 


OATE: ASSY  AMBIENT  TEMP: 

PROGRAM:  Nxy  ASSy 


qt>  *r 


NHA: 


Co»n  pu  o>-  C 

SCHEMATIC  NO: 


SHEET  1 OF 

C^»v-4  Ho. 2.  - 


OUANT 

FP 

FART  TTFE/ASSENRLY 

3 

T.C^  SSX/N^t 

C M3  £ lo  /o  noi) 

($HS+i"\S) 

3 

T.C.,  SSX/msX  "iKa-til 

(/*  o / O 1 00  0 

i) 

IS 

T .C.,  S ST,MSi 

STRESS 

RATIO 


INDIVIDUAL 
FAILURE  RATE 

<XJ 


total  failure 
rate 

PlXJ 


K.SST^>T  -Ron. 


-t>  ~b»t  ~f p.on 


C-aptcit  «v,  Ctv*'~»tc. 


Gap'Vc^A-r,  S»\vi. 


CAsnu) 


CHM-iUZo) 


C.CKA') 


Ccsso 


ASSEMBLY  FAILURE  RATE FAILURES/ 10*  HOURS 

G-2  8 ASSEMBLY  MTBF IT.,  IS  S HOURS 


DATE:  

PROGRAM: 
NHA:  


RELIABILITY  PREDICTION  DATA  SHEET 

AtA'bOANE.  Un»NMA«iTCI> 

- =10 


ASSY  AMBIENT  TEMP: 


.ASSY: 


QUANT 

PART  TYPE/ ASS  EM  ALT 

n 

T.C., 

□ 

T.c.(  SST/M  CM.335io/onol.; 

Csn.S4  r>  S') 

ma 

T.C-,  ssr/nsr.3>.<£.-t->.l  O'sssto/o  10# ») 

C$ns 4-Ai,) 

is 

T*C.,  sst/^st 

(AnZ^s) 

l 

T.c.(  SST/nsx  L\wir»»-  C*  3851®/  i°i®0 

z 

‘'fciaic,  Cr<  * Or* l 

CTAmttC) 

u 

C*>ri.rr\kc 

CCK^i 

HI 

L v“t-0>r("Ti.^.-V  4 S*wi 

CcsiC) 

8 

tsisxo^,  r. 

Cftbfft 

l 

\ 

Corw^c/to^, 

: *c 

"RAM  CAtA. 
SCHEMATIC  NO: 


STUMS 

RATIO 


SHEET 


INDIVIDUAL 
FAILURE  RATE 

fX) 

total  failure 
RATE 

nx> 

a-ul-o 

*ZZ.5uo 

0.  m 

0 .333 

0.  in 

0.35& 

0 .353 

5. 32.5 

c. 

0.  4-2o 

0 .1*0 

0 24o 

O.OU. 

0.13?. 

o.oLfc 

0.052 

0.0  10 

O.  0&O 

&.000 

6 .300 

1.84-0 

1.84-0 

ASSEMBLY  FAILURE  RATE  *5~  340  FAILURES/ 10®  HOURS 

“Xi,  051- 


ASSEMBLY  MTBF 


umiDc 


DA^r 


rte 


18  G-2! 


RELIABILITY  PREDICTION  DATA  SHEET 

A ‘BO'p.KGL 


DATE: 


PROGRAM:  Nav 

NHA:  


ASSY  AMBIENT  TEMP: 

^l^lLIll^l_ASSY: 


*C  SHEET 

ToY-t  U%%  it  C*a.Y-<i  


SCHEMATIC  NO: 


OUANT 

<n> 

BAHT  TYPE/ ASSEMBLY 

-5 

X.C.,  S&X/MST'i<^'tn  o»««  V) 

CSN  5**»0 

X.C.,  SST/rt-SI  D'g.tu  C«3S5ie/ooioSr) 

C i*-5"-S-«0 

mm 

SsXjMSt  i&/ooioi) 

CSN-S^lO 

n 

T.  C.,  SST/^SX  tigrtu  CM38Slo|onoO 

(snS‘4-11^ 

T.C.,SST(K3I  Cn38Sio/o Hoi) 

(sNS4ri5} 

■a 

T.C.,  SST|>VSX 

C3>Hlo*ibD 

e 

CCKtO 

C’apicvtov,  v * 

Ccsio 

mm 

C»  VMARCto'r^  ^o"T»v% 

STRESS 

RATIO 


INDIVIDUAL 
FAILURE  RATE 

00 


o -10*5 


o.  1 1 1 


o *o^<V 


total  failure 

RATE 

mXJ 


RELIABILITY  PREDICTION  DATA  SHEET 

AVRfcORMS:  UNIAtNA'BVTEO 


DATE:  ASSY  AMBIENT  TEMP: 

PROGRAM:  N>y,  ASSY; 


*C  SHEET 

"C/o  *o-t 

_ SCHEMATIC  NO:  


QUANT 

<T> 


f ART  TYPE/ASSEMRLY 


STRESS 

RATIO 


\C  55 t/MSI 


Cam  is-**) 


T.C.#  5ST/MSX  (.M3SSio/oo»o4.) 

X,c.  SS^EjniX  C^^BSlo/ 004A  0 

C5NS4  02.) 

x.c.^ssx/msi.  (jMasio(o  ixoa> 

0^54-123^ 

X.C.,  S5C  /AST  Dij.til  C43  5SJo/ot3oW) 

CSN54  |fci) 

t.c,  sst/ nsz (Vos^o/aono^ 

CSN54  IWV) 

X.c_,S^T /«SX  ‘iij.ti.k  CM323lo/o'U01> 

Csn54lshO 

T.c.(  ssx/hst. 

C3M34S251) 

X%Cf  SST(rt5X  UmClY-  I^M^BSlo/  IftlOl*) 

Claia-0 

C**p  acv'tov 

CcKILi 

"a»-  ”F\  I m 


I “Rt.*  Is'taT  Ov^p  Ji  (tl*  v» 


\ c 


CCS  no 


CKlr) 


C^ctO 


INDIVIDUAL 
FAILURE  Rate 

(JO 


'■311 


o-ei\ 


0.163 


6.UI 


O .14(. 


0-141 


o.UL 


O.IU  J, 


o.  4Zo 


O.OU, 


O.OlW 


q , oi b 


o .oo  S 


1.84o 


TOTAL  FAILURE 
RATE 

(TlV) 


1.1 4-4. 


0,142 


0 10W 


OlU 


0-151 


0*84 


».«US 


0.319 


1.00% 


0.84c 


3.11L 


O.lOO 


o.loo 


1.&40 


ASSEMBLY  FAILl 
ASSEMBLY  MTBF 


FAILURE  RATE  )~Ll  ^22l  FAILURES/ 10*  HOURS 

**-“«=•  3%.  515  HOURS 


PAGE 


RELIABILITY  PREDICTION  DATA  SHEET 

AUVRORNE  dNiMHfrfciTCS 


DATE:  ASSY  AMBIENT  TEMP:  *r  SHEET  j OF 

PROGRAM:  S+>~»y^«wv~C.»r^:iat  N *v.  >cgv  T/  0 Hi . Z 

NHA:  — — SCHEMATIC  NO:  


QUANT 

Fl> 

PART  TTPf/ ASSEMBLY 

imu 

RATIO 

INDIVIDUAL 
failure  rate 

00 

total  failure 

RATE 

<nxj 

1 

T.Si,0^.+  -?*OK  OmJJoo) 

— 

1.31Z 

t -312. 

IB 

T.  t.i  iST|>»  SX  CAHISOe') 

— 

o.  on 

O.tHl 

Is 

T.C#  SST/M^X  t>! 9 Si*foQM4)  io) 

— 

o aol 

0.412. 

In 

'X.C.SSTJMSX  C«J8Sto,'o64o  C)  CSM5-4»0 

- 

O.ui 

0,444 

In 

X.C.(SSx/nst  C«3aSio/»iioJ)  ^^54113^ 

— 

o.i2<« 

o.lZL 

L* 

T.C.,Ssx/nxt  O 3BS*o/e,>oU>  (;SrtS4»(»0 

— 

o.**U 

0.4m 

5 

-n.c.(ssx/^sx  L.^.tvi  C«3S5’»o/oo<103,)  CSi  S4  IC.4^ 

— 

0.2.41 

0.U4 

li 

T.C,  sst/rvsx  Cmes-ul  01102-';  CsrHS4tSli2.) 

— 

O.UL 

o.lSU 

T.C.,  ssx/nsx  CSH54SZET) 

— 

O.IU8 

2 .Oil, 

i 

TX,,  SST/KST  Uvxt^v\n38S(o^\oi*)  £ 

— 

0.41.0 

0.426 

8 

Yj  -T*r>r'aw*vc  CCK^T) 

1 

o.oli 

0,1% 

IQ 

C»-f  a ▼,  "Ti-^  . St  W i CcSlL) 

BIB 

O.OU» 

005^ 

|l 

'Rcais'to'r  CKLH3 

n 

o.oto 

0.200 

40 

mm 

o.eo^" 

0 .260 

i 

Gw***tjt*  y"<  ^ VVA 

BW 

"T , &4-0 

1.840 

4 

« 

1 

ASSEMBLY  FAILURE  RATE  V-S“^  1 FAILURES/ 10®  HOURS 
’“32  ASSEMBLY  MTBF (»4,34U HOURS  PAGE 


IL 


OF  _JJL 


I 


RELIABILITY  PREDICTION  DATA  SHEET 

M'fc’BoRNS  UNIM  H A'BtTSD 


DATE:  ASSY  AMBIENT  TEMP:  S12 *C 

PROGRAM:  ASSY;  Tou.tr  SuppW 


SHEET  ! OF 

A5se.v^Vvl 


NH  A : 


SCHEMATIC  NO: 


QUANT 

<n» 

PART  TYPE/ASSEMBLY 

•Stt 

T«\e 

INDIVIDUAL 
FAILURE  RATE 

no 

TOTAL  FAILURE 
RATE 

<n\) 

\ 

1 

>3.^83 

■I 

■+  5 Va\-t  Sopf\>i  Ko^wie 

n 

0 .Q3S 

0.83S 

mm 

(,  . 13© 

(,.130 

o a H — * — 

1 

s 

ASSEMBLY  FAILURE  RATE 


Zl  .S+B 


FAILURES/106  HOURS 


PAGE 


I S' 


OF 


ASSEMBLY  MTBF 


4-0 


HOURS 


'8  G- 


RELIABILITY  PREDICTION  DATA  SHEET 

MTVbolnE  UNIN 

DATE:  ASSY  AMBIENT  TEMP:  *C  SHEET  L_  OF 

PROGRAM:  X^t-rEva-l  H Taw  t-*-  SoffW  A 

NM*:  SCHEMATIC  NO:  ______ _ 


| QUANT 


PART  TYPE/ASSEMBLY 


STRESS 

RATIO 


INDIVIDUAL 
FAILURE  RATE 

OJ 


l 


T.c.  SST/mST  Lv<-*i.>r 


CI.HIOS) 


o.ZHS 


It 


"C.C^  SST/hjj  L^eir- 


T.C.  SSr/^sT  !<*«•*.*- 


~TVuv>SvS'Lo>>~l  NPH,  U vv>  « -Vr- 


(unm) 


C l* » 3*0 


«•  i 


461 


o.  481 


o -ol^ 


”t*V-»V\SVS't‘o'r  , ~t*IH  P L 


c.i 


o-l3o 


11 


XlO^A,  (»« 


""Poypos^ 


'b  l«^v  It 


tv 


O .1 

OX 


0 .ilo 


0.144 


13 


0.1 


\ 0 

16 


Ctp  I a.W"t\  So \ \ A 


Ccsi'i 


o .4- 


o >o2.<# 


C<.>r'a->APIV^ 


Cc*P} 


0 ,4* 


o.oU 


C-ap^cvt*  V“  ~Po\>l  ov  W.v,*4t. 


CCHtL) 


0.4 


0. 00 1 


31 


'K^sis'Eov  \ i 


Cfci-W) 


o.l 


0-0  10 


>v*  l 


jtsv,  l~ . 1 1 


o .1 


O.ou 


zu 


Tl«5ist*\r  C-2  v'o*v.C*»M  poi»ti 


I 0<*< 


CkctO 


0.1 


o.ooq 


ft 


'P.gjis'toy  \M  ,\M.  ' 7eWI.< 


0.1 


o.  OIL 


it 


’"Re.six't  o-*-,  Vi.'rvxWl 


CftTTC> 


c*v\  . ~e 


0 Uj  tV" 


^TV-a.*  s^b,  e>“7Towe  v- 


O .1 


o.o53 

0»10\ 
o Abi 


ASSEMBLY  FAILURE  RATE  FAILURES/ SO6  HOURS 

G-36  ASSEMBLY  MTBF ~lV>,Sl  g HOURS  PAGE 


!k_  of  _LL 


i 


RELIABILITY  PREDICTION  DATA  SHEET 

AiVbOKNH-  JNInH  A-T^TTIt? 


DATE:  

PROGRAM 
NHA:  


ASSY  AMBIENT  TEMP: 

. ASSY. 


mc  SHEET 

T<o  C-n-A  Ko.3 

_ SCHEMATIC  NO:  


J OF 


QUANT 

<n> 


PART  TYPE/ASSEMRLY 

T.C.^  IOZV&i+YROIA  (/'iBS'io/  ooioA-) 

C«MS'3oo) 

T.  C.(  SSX/MVE  0“*3SSlo/ooto4-) 

Css  5-400^) 

T.C,,SVl/ttSX  C^^SSio/e^tos) 

C-SN  S4*4} 

X.  C.,  S5X/MSX  t>  i^.t  L*33S‘io/o«  toi) 

Csns^io) 

1LC,  SS^I^XX'C  -ta.l  (n38  £•!«/«> 

0*54*  »} 

T,C(  SSE/'^S-C  'bij.ty  13*0 

On  5*  1 U3) 

“C.C.,  Ss'B./MSZ.'tnjftxl  35S't>/ooioO 

CiNSi-U.S') 

T-c>,  SsX/^SC.  £m33£io/o  ~l »0 2j> 

(Sf-LS^t-Sm.) 

X.C-,SS T/AS1  Li*c:iv-  |6I»0 

C^picvtov,  Ct 

CCK^O 

CcstO 

"RtS  istov  r,lm 

Ciu-*-*) 

STRESS 

RATIO 


INDIVIDUAL 
FAILURE  RATE 

(X) 

total  Failure 
rate 

<nX) 

1.31X 

Z.14-4 

0*103 

a .ZOU 

d.m 

o.SSS 

0 .0^4 

0 .044 

0.08X 

0.0SI 

o.l*U 

1.4% 

0.2,4  U 

0.4  64 

0.  IZU 

0.3T8 

0 . 4Zo 

3.410 

0 ,oU 

o,nu 

O.oZL 

0 oSZ 

1 .840 

1 .840 

O .0  10 

0.VS0 

0 .QO-S- 

0 OZS 

DATE:  ASSY  AMBSENT  TEMP 

PROGRAM: 


RELIABILITY  PREDICTION  DATA  SHEET 

Aiv\»ovv>  a.  ^ Vvj.'io  vtc  A 

ASSY  AMBSENT  TEMP:  *C  SHEET 

>ggv  h,it  Card 


SCHEMATIC  NO: 


QUANT 

<T> 


FART  TYFE/ASSEMSLT 

T.C.,  SSl,nn 

Cci  4oS3} 

T.C.,  SST/mO  ‘b.&.'fcil 

Cam  isoo) 

S’.  C.,  Sst/msx  I 

Csnsausso) 

X.C^SST/^iST  T).j<ta\ 

tt.c.ssx/msi 

Csns+iuO 

T.  C^SSV/^ST  CA3eSV«/ol30j^ 

CSMSAIC.*) 

r.c.,  ssxfMrx.  Utecx- 


'tsioA«.)  "t‘o>rp*S< 


>>  CcriMiL 


Cc 


?><svs  tov)  r,lm  


T\tS  \ 7 % \ fn 


l$*V%  < \*J  . NW.^  Touit*< 


HttuTov|  W ,W.  ^ 


*T^e$l»-t"b  r%  V •xv  1 1 


T n iwt^*  dV*, 


H « t 


C.  o «y\«CXo  y-  «^o 


C*lV) 


C*hO 


C***) 


(wW) 


CktK} 


STRESS 

RATIO 


x.c.,  ssx;/mjx  "» iji  >i.i  ( 

C^-S£,o/o»ioS') 

C SMXAOA) 

I.C.SST/HST 

Cm36-SIo/ooioIl) 

CSM  S4T-<0 

X.C-,  SST/MsT.  'iij.ti* 

C^3»SIo/oi3ol1) 

(>M  SAlCl) 

T.C.,  SST/tvJX  L.i*tav- 

C*-3351o/(oio  0 

Qumiai  ) 

SSX/MSl.  LjVrav 

C*-m  ul) 

T.c^  SST/HtH  U%Aru^ 

Cl-«'34') 

IsTov,  Nprn,  LiviCar 

CTANTx.} 

*TVx»\s«5T«-r1  Tk?,  Ltv*«ir- 
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COMPUTER  FLOW  CHARTS 
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REALTIME  INTERRUPT 
(1 28/SEC) 


X = TOP  OF  QUEUE 


Flowchart  H-l 
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INPUT  DELTA  VELOCITIES  AND 
GYRO  RATES  AND  MODES 


AVay  . A0gx  ; X MODE 
AVby  ; A0gy  ; Y MODE 


ALIGN  ACCELEROMETER  AXIS 


NOTES: 

1.  FOR  IMM  NO.  1 THE 
MODE  CONTROLLER 
SET  BTT  = |BTT1)A 

2.  SIMILAR  SETS  OF 
CODE  EXIST  IN 
MEMORY  FOR  EACH 
CHANNEL  (I.E.,  BTT2, 
BTT3,  BTT4) 


1 APPLY  ACCELEROMETER  1 



BIAS 

> 

< 

o 

X 

= AVtx  + Abx  At 

avcy 

= AVjy  ^ Agy 

BODY  TO  TETRAHEDRON 
COORDINATE  TRANSFORMATION 


Avs  = vf  ( Avbv-Avbv-AvbZ> 
^S1  = ~k  ‘"^bx  Aeby-AV 


GYRO  COMPENSATION 


SELECT  AND  APPLY  GYRO  SCALE  FACTORS 


NOTE  3:  SEE  GYRO 

SCALE  FACTOR 

cry  - (CX)A  DATA 

SGX  - IbX)  ORGANIZATION 


ACCELEROMETER  COMPENSATION 


X MODE 


HIGH  RATE  MODE 

1 

SGX  = SGY  + 6 


APPLY  ACCELEROMETER  SCALE  FACTOR 


SGX  * SGX  + 3 
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SGX  = [SGX]  * + (SGX  + 2]  * ’ 40, 

^x  = sgxa^gx 


SGY  - <SY)a 


GYRO  SCALE  FACTOR  DATA  ORGANIZATION 


1ST  ORDER  S.F. 


Y MODE 


= HIGH  RATE 
MODE 

’ I 

SGY  = SGY + 6 


SGY  - SGY + 3 


SGY  = [SGY]  * + [SGY  + 2]  * M( 
= SGY  1 


GYRO  TORQUER  AXIS  TRANSFORMATION 


^TX  * SGXX  ^X  + 5GXY  ^Y 
^TY  = 6GYX  ^Y  + 5GYY  ^Y 


GYRO  INERTIA 
COMPENSATION 

4*IX  * Iq  ' (AflTY  “ ^TY  1 
^IY  = lG  (^jX-^TX* 


* 2nd  ORDER  S.F. 
‘j-  1st  ORDER  S.F. 

* 2ND  ORDER  S.F. 


* 2nd  ORDER  S.F. 


1ST  ORDER  S.F. 

* 2ND  ORDER  S.F. 
*j.  1st  ORDER  S.F 

* 2ND  ORDER  S.F. 


* 2nd  ORDER  S.F. 


1st  ORDER  S.F. 
* 2ND  ORDER  S.F. 
1ST  ORDER  S.F. 
ORDER  S.F. 

51  ORDER  S.F. 
ORDER  S.F. 

T ORDER  S.F. 


2ND  ORDER  S.F. 


POSITIVE 

INPUT 


NEGATIVE 

INPUT 


POSITIVE 

INPUT 


NEGATIVE 

INPUT 


POSITIVE 

INPUT 


NEGATIVE 

INPUT 


POSITIVE 


NEGATIVE 


INPUT 
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NOTES:  4.  FOR  IMM  NO.  1 THE  MODE 

CONTROLLER  SET 
TBT  = (TBT1)A 

5.  SIMILAR  SETS  OF  CODE 

EXIST  IN  MEMORY  FOR  EACH 
CHANNEL  (I.E.,  TBT2.  TBT3, 
TBT4) 
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COMPUTE  GYRO  PARITY  EQUATIONS 
n 

APb12  - A0b,x  + A0b1z  + A0 b2x  -Aflb^ 

APg23  = Mb2x  -Aflbjy  + A0b3x  + A^bgy 

Ap934  = Mb3x  -Aflb3z  + A5b4x  + A0b4z 

APg41  = -A0b4x  + Aflb4y  + A0b1x  -A0b1y 
ApS13  = Adb1y  - Aflb1z  - Aflbjy  + A«b3z 

I APg24  = Aflb^  + A0b2z  - Aflb4y  A0b4z 

7 

FILTER  GYRO  PARITY  RESULTS  AND  SET  FAIL  INDICATORS 

t 

L912  “ L®23  = *^34  “ l941  * >-9i3  ' Lg24  - 0 


_n  n-1  At  . n-1  n 

P*34  * P“34  “ t P“34  + Ap834 


n-1  n 

“41  + AP“41 


nn  At  * n-1  n 

Pg12  ' Pg12  " ~ Pg12  * APg12 


n n-1  At  . n'^  n 
P*13  = P*13  “ T Pfl13  + AP»13 


|Pg12|-Ag^ 


Lg12  = 1 


n n-1 


n-1  n 


P®23  * P“23  ~ T *P®23  + AP«23 


„n  n-1  n-1  n 

P*24  * P®24  ~ T P*24  + AP«24 


^23 1“^ 


Uj3  - 1 
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*-*12  * *-*23  “ *“*34  = *-*41  ~ *-*13  “ *-*24  “ 0 


4 

n n -1  At  • n-1  n 

Pa12  “ P*12  " T P*12  + AP*12 
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COMPUTE  ACCELEROMETER-FAIL  EQUATIONS 


L*1  - d-ai2  ® *-*41  ) © ^***12  ® ^*13^  © ^41  ® *-*13^ 

Laj  “ (La-|2  (x)  La23>  © (La12®  La24)  © <*-*23®  *-*24* 

La3  = (La23  © La^)  © (La23  (X)  La13l  © (La^  ® La13l 

La4  = (La^®  La14)  ©(L«34®La24>©(La41®  La^l 


COMPUTE  ACCELEROMETER  PARITY  EQUATION  ERROR  DISCRETE 


Lang  - [La12  (X)  (La1  ® La2)l  © [La^  ® (La2  ® La3» 

© lu34®  ,u3®  u4)]  © [La41  ® (L^7 
© lLa13®(La,  ® La3)]  © (La^  ® (uj®  La4»] 
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Flowchart  H-4.  IMM  Initialization  (128/sec)  (Sheet  2 of  2 ) 
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COMPUTE  DIRECTION  COSINES 


C> 

n 

C> 

r 

C> 

n 

c> 

r 

Cx 


,"»2 


= IQ1r-(Q2)^-{Q3)‘i  + (Q4) 


2 (q;  q 
2 
2 


n 
(Ql 
n 


n n 
Q3  Q4) 


n n n 
Q-,  + Q-%  • Q4) 


IQ 


J2 

n 


n 


1 


Q2  + Q3  <V 


n n n « n >) 
(Q1)2-(Q3)2  + (Q4)Z 


PERFORM  BODY  TO  LOCAL  LEVEL  COORDINATE  CONVERSION 


n+1/2 

n n+1/2 

n n+1/2 

n 

z 

X 

> 

<1 

= Cxx  AVbx 

+ CXY  A Vby 

+ cxz 

n+1/2 

n n+1/2 

n n+1 17 

n 

avyn 

= CYX  a Vbx 

+ Cyy  ' A Vby 

+ Cy2 

n+1/2 

n n+1/2 

n n+1/2 

n 

avzn 

■ CZX  AVb* 

+ Cjry  ’ A Vby 

+ czz 

f 

AV 


I 


NAVIGATION  VELOCITY  SUMMATION 


n+1/2 

n— 1/2 

n+1/2 

XN 

* VXN 

+ avxn 

n+1/2 

n— 1/2 

n+1/2 

YN 

= VYN 

+ avyn 

n+1/2 

n— 1/2 

n+1/2 

ZN 

“ VZN 

+ avzn 

I 


^ RETURN  J 
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PITCH 

= SIN'1 

(CZY| 

ROLL 

= TAN'1 

czz 1 

AZIMUTH 

= TAN  < 

cxx 

CVY  ' 

HEADING 

= AZIMUTH-ALPHA 

FORMAT  AND/OR  SMOOTH  THE  FOLLOWING  PARAMETERS 

PITCH  ; ROLL;  HEADING  ; PITCH  RATE  ; ROLL  RATE  ; 

YAW  RATE  ; LONG  ACCEL  . LATERAL  ACCEL  ; VERTICAL  ACCEL 
VELOCITY,  NORTH  ; VELOCITY.  EAST  ; VELOCITY,  VERT.  ; LATITUDE 
LONGITUDE  ; ALTITUDE 


^ RETURN  ^ 
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COMPUTE  NAV  SYSTEM  VELOCITY 


< + VXN  + (VXCR  + VXCL* 

AtN 

< + VYN  + (VYCR  + VYCL* 

z 

4^ 

<1 

! * VZN  + (VZCR  + VZCL> 

AtN 

ZERO  DELTA  VELOCITIES 
AND  VELOCITY  UPDATES 


<0  (ALIGN  MODE) 


(NAV  MODE) 


DO  ALIGN  FUNCTIONS 


DO  NAV  FUNCTIONS 


vz  = 0 

Wy  = 0 

w?  = o 

VXA  = VX 
VYA  “ VY 

TPX  = TPX  - VYA  KT  AtN 
TPY  = TPY  + VXA  ' KT  AtN 

WXC  = TPX  8 
WYC  = TPY  8 
TPX  = TPX  - WXC  AtN 
TPY  - TPY  - WYC  AtN 

VXCL  * “ VXA  KV  “ GEE  TPY 

VYCL  = “ VYA  ' KV  + GEE  TPX 
BXC  * BXC  - VYA  KV  AtN 
BYC  = BYC  - VXA  KV  Atw 


RHOX  * - VY  RE2-VX  RE3 
- VX  RE1  + Vy  ‘ RE3 


WXS  + RHOX 
WYS + RHOY 


B1 1 ~ rhoy 

®21  + RHOX 


B12  “ RHOY 
B22  + RHOX 
B32+(RHOX 


B32  ’ AtN 
B12-RHOX 


B21 > AtN 


B„)  At. 


NAV  RATES 

WXY  - - (Wx  ♦ WXC  + BXC) 
WYN  - - (WY  + WYC  + BYC) 
WZN  » - (Wz) 
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UPDATE  QUATERNIONS 


| LB  | 2 = (WXN  WXN  + WYN  * WYN  + WZN  - WZN) ' (At^l 

T,  « (-Qj  WZN  + Q3  WYN  + Q4  WXNJ ' AtN 

T2  * (-  Q3  • WXN  - Q4  WYN  + Q1  • WZN) ' AtN 

t3  - (-  Q4  WZN  ~ °1  WYN  + °2  ' WXN) ' AtN 
T4  - (-  Q1  ' WXN  - Q2  WYN  - Q3  ' WZN)  • AtN 

Q,  *=  Q,  +Q1  C|ff|  +1/2  T,  + 1/2  S|9|  T, 

02  - Qj  + Qj  C|fi|  +1/2  T2+  1/2  S|fl|  T2 

Q3  - Q3  + Q3  C|0|  +1/2  T3+1/2  S|fl|  T3 

q4  - o4  + o4  • c I e | + 1/2  • t4  + 1/2  • s| 0 j ■ t4 

e » 1 - (q12  + q22  + q32  + q42) 


RETURN 
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Flowchart  H-10.  Instrument  Compensation,  Slow  (2 /sec) 
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At  * 2 


-3 

(Ah  - hO)  ’ (0.5) 


3 KTA 

DRG  S2/(16*  (1  + DGR  S2/16)) 

4 (KTA)2  + g ’ 10"7 
2 (KTA)3 


h-S4-hbj 

h 

S4  + K4  Ah 
S3  + K3  Ah  At 
Vz  - K2  ' Ah  At 

h - K1  Ah  At 


VZ  " V2  - S3  At 

. — i — v 

( RETURN  J 


Flowchart  H-12 


Altitude  (2 /sec) 


GO  TO  MODE  NO. 


Flowchart  H-13.  Mode  Controller  (1/sec)  (Sheet  1 of  2 ) 
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Flowchart  H-13.  Mode  Controller  (1/sec)  (Sheet  2 of  2 ) 
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APPENDIX  I 

ADVANCED  FAILURE  DETECTION  AND 
ISOLATION  ALGORITHM 


403314 


1*  Failure  Detection  and  Isolation  Algorithm  for  Tetrahedral 
Array  of  Four  Valid  Gyros  " 

Test  relations  for  a tetrahedral  array  are  obtained  from 
the  centroid  relation 


e13  e23  + e33  " e43  “ 0 


(1) 


where  spin  axes  e^  are  taken  outward  from  sides  of  a pyramid. 
For  test  directions 


e ..  x e _ 
_ r3  s3 


where  Sn  = 


rs 


Note,  by  multiplying  (1)  by  er3x. 


Since 


Then 


eT  **  eT  + eT  ~ eT  ® 

rl  r2  r3  r4 


eT  - “ eT  and  eT  = 0 
rs  sr  rr 


e = e - e 
T14  T13  T12 


eT  GT  eT 

13  23  34 


6T  ST  **  eT 

12  i23  l24 


eT  eT  _ eT 

14  X24  X34 


(2) 
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Using  the  first  relation,  the  absolute  value  yields  C 


T,  _T, 


1/2  and  multiplying  by  3 , a relation  for  test  duration  rota- 
tions is 


014  - ei3-°12 


(31 


where  subscripts  indicate  the  test  direction. 
Note,  the  unit  vector 


(?T13  + + Ch3Tl2) 


= / e 


(%3  + 


is  normal  to  e , hence,  in  the  No.  1 gyro  sensitive  plane 
T14 


e = 9 e j (6i3  + 6]-2)  ; 

14  T14  nT3  N 


(4) 


14 


The  magnitude  of  the  rotation  is 


e*  = e . 0=  e 


14 


' 6 13  + 612>  ^ 


= f( 
■f( 


2 2 2 
012  + e!3  + 614 


2 2 2 
912  + 613  + «14 


) + l[6 
) 


14 


12  13 


)■] 


(5) 


using  (3) 
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Defining  T^s  as  the  test  difference  of  r gyro  and  s gyro 

outputs  in  the  direction  e , then  it  follows  the  square  of 

Irs 

rotation  amplitude  8-^  of  gyro  No.  1,  if  other  gyros  are  perfect 
is  given  by  the  calculation, 


> * - ! / 
1 “ 3 l 


2 2 2^ 
T12  T13  T14  I 


, that  is  = 8^  for  only  gyro  No.  1 drifting. 

Multiplying  (2)  by  0 • obtain  relations 


0 13  623  ” 0 34 


9 12  = 9 23  - 024 


(6] 


0 . . 0,,  0,. 

14  = 24  = 34 


hence  if  only  gyro  No.  3 drifts. 


T =-0  = -0  +0  = T +T 

13  13  23  34  *23  34 


and  if  only  gyro  No.  2 drifts. 


T12  * -612  = -023  + °24  = - T23  + T24 


and  if  only  gyro  No.  4 drifts. 


T14  *-914  “ -024  + 034  = T24  ' T34 
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It  follows  that  the  calculation 

F1  = ![(T122  + ha'  + T142)  ' (T23  + T34  ' T2J2]  (6a> 

has  the  output 

2 

6^  if  only  gyro  No.  1 drifts 

0 if  only  gyro  No.  2 drifts 

0 if  only  gyro  No.  3 drifts 

0 if  only  gyro  No.  4 drifts 

Thus  serves  to  detect  failure  of  gyro  No.  1 if  only  one  gyro 
fails  at  a time. 

It  may  be  similarly  shown  that  test  functions  for  the  other 
gyros  are  : 


In  order  to  evaluate  the  response  of  the  test  functions  for 
general  drifts  of  all  gyros  we  shall  express  the  drifts  in  terms 
used  in  a later  section. 


1-5 
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Extending  (17)  for  four  gyros  in  tetrahedral  configuration 
it  may  be  shown 


T 


12 


O 


13 


= Dr 


+ D„ 


-0  -30° 
3 


23 


= Dr 


+ D. 


O 


T 


24 


S 


e 


4 


T 


34 


S 


e -60 
3 


O — 


-60° 


where  9^  are  drift  directions  relative  worst  case  directions. 


Where 

Xr  = DF  C9  + 30° 
r r 


DF  * S9  + 30° 
r r 
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it  may  then  be  obtained. 


12 


13 


23 


14 


(X1  - 

x2) 

• — + (Y  - Y ) 

2 1 1 1 2 2 

( X3  “ 

xi) 

' 1 + (Y3  + V X 

-(X2 

+ X3) 

■ T + <S2  + Y3>T 

1 Y */3 

1 

> 

1 

X4 

2 4 2 

(6c) 


24 


_y  + y • i — y 

X2  4 2 42 


Note, 


T34  = X3  + X4 


(T12  + T23  T13) 


xi  - x2  - x3 


(T12  + T14  " T24) 


-X,  X_  r •% 

■ ~t + T - x4  + <Yi  - V — 


(T14  + T34  - T13> 


-X  X X 

nr  + t + -r  - (Yi  ♦ y3  + V i 


\f  3 


(T23  - T24  + T34> 


X_  X^  Xyi  ro 

-r  + -T  + -T  + (y2  + y3  + y4»  t 


The  selection  of  variables  Xr,  Y leads  to  analysis  of  F4  of  (6b) 
which  is  simpler  than  other  Fr* 
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Obtain 


= DF,2  + f X4  (X1  - X2  + 2X3>  + 7S  Y4  (X1  + X2> 


+ (XXX2  + X1X3  - X2X3) 


F3  ‘ DF32  + ! X3 


(2X4  ' T + IT  + f <yi  ' Y2>) 
( 2 *1  * 2 Y2  ' T <X1  * X2*' 

fXl(^-  X4  - Y2  f )*  j X2  (X4  -Yl^) 


+ f Y3 


(7) 


+ 73  (X4  Y1  - X4  Y2>  + Y1Y2 


2 2 2 

where  Dp  = xr  + Yr  * Consider  the  mean  and  standard  deviation 

of  F if  gyro  No.  r fails  with  given  D_  over  the  set  of  random 

r — 2 * r 

phases . Note , F = D„ 

r F 

r 

assuming  independent  gyro  drifts.  Also, 


.2  4 


(F4-F4)‘  = x4  • f <xi  " x2  + 2X3}*  + Y4  * I (X1  + X^ 


+T  1X1X2  + X1X3  - X2X3)2 


_ 4 ^ 2 2 4 4 

3 °F4  °N  + 3 °N 


USing  Xr2  = Yr2  = aN2/2  for  r = 1,  2,  3 and  X2  = Y 2 = D 2/2. 
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Then 


4/f, 


4 r sm* 

M 3 


where  r = N/Dt 


(8) 


If  the  noise  is  .l°/hr  and  the  failure  rate  l.°/hr  then  the 
lo  variation  of  is  11.6  percent  about  the  average  due  to  noise 
of  the  other  gyros.  By  symmetry  the  same  relation  holds  for  all 
F , however  to  demonstrate  the  consistency  of  the  above  relations 
for  F^,  obtain  as  expected. 


<F3-F3>2  * X32  ' I (2X4  - T-  + T + ^ (Y1  ' Y2>) 


+ Y. 


l(‘l  vi  + 1 y2  (xi  + 


X2  Y + y 2 ifvv 

X1  ' 9 \ 2 X4  Y2  2 / + X2  '9  \X4  Y1  2 * 


+ f (x4v1  - x4y2 


= 1 D 2 • o 2 + 1 o 4 
3 F3  N t 3 N 


7 2 

If  none  of  the  gyros  failed,  then  F^  = = oN  and 

r r 


o ^ = (F  - F ) ^ = — a ^ 
Fr  v r r'  3 N 
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Expressed  as  a fraction  of  the  output  with  a test  failure 
rate  Dp,  then  the  lo  spread  of  outputs  is  given  by 


F 


r 


D 


F 


2 


where  r = c^/Dp.  If  = .l°/hr  and  Dp  = l.°/hr  then  the  output 
ranges  la  from  -.63%  to  +1.63%  of  the  output  for  an  actual 
failure  with  test  level  magnitude  D_. 

In  order  to  evaluate  the  probability  of  no  detection  of  a 
failure  and  false  alarm  a more  detailed  analysis  of  the  probability 
distribution  of  errors  is  necessary.  This  can  be  done  by 
examining  F4  of  (7)  assuming  the  gyro  noises  are  Gaussian. 

The  analysis  of  probability  distribution  of  Fr  is  facilitated 
by  putting  F^  of  (7)  in  the  form, 


F 


4 


R 


r 


2 


where 


R2  = X*2  + Y*2 
4 4 


r 3 *X3  + X2  Xl* 

Xj  = X4  + i ( 2X3  +XX- 

Y4  = Y4  + 73  <xi  + x2> 


x2) 
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It  is  readily  shown  using  X ^ = Y ^ - °N2/2  for  r ~ 1»  2'  3 


° 2 = a 2/3 

X*4  N / 


i^  = a / 3 
Y*  N 


7 2 

a = 2 /3  Regarding  X4 , Y4  given 


X*  = X. 
4 4 


Y*  = Y . 
4 4 


r = 0 


(X*4  - Xj) (r  - r)  = 0 


(Y* 4 - yj)  (r  - r)  = 0 


<X%  " *J)  <Y%  " Y*4>  = 0 


regarding  X.,  Y as  given  rather  than  random  variables.  Regarding 


4 4 

X„,  Y A as  random 
4 4 

variables 

with  X.2  : 
4 

°*%2 

■ °Dr/2  + 

0 2 
r 

- 2 aN2'3 

2 - v - V' 
2 ,, 


N 


Regarding  X4,Y4  as 
random  variables 


X*  = 0 
4 


Y*  = 0 
4 

r = 0 
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(X*  - X*)  (r  - r)  = 0 


<Y*  - Y*) (r  - r)  = 0 


<x$  - x|)  (YJ  - YJ)  = 0 


Since  Xlf  X2,  X3  are  assumed  normally  distributed  then  so 
is  r.  It  follows  r2  has  a Rayleigh  distribution 


*<r2)  - -i,  • e’r2/or2 
°r2 


Since  r is  independent  of  X*,  Y*  the  joint  probability 
density  of  X*,  YJ,  r2  is 

2 2 

MXJ,  V*,  r2)  dXJdYJ  dr2  = *(x*,  YJ)  e ^ d(r2/or2)  ‘“‘"J 


The  Probability  distribution  of  F4  is  obtained  substituting 
r = xj  + Y4  - f4  and  integrating  over  X*,  Yj  such  that 

x42  + y*a2  * G(F,,0)  , 


‘)>(F4)dF4 


■Si 


dxJdYj  4>(xJ,yJ) 


(X42  * Y*42)  , 

ar2 


a 2 
r 


dF, 


(9) 


(xj2  + YJ2)  > G(F4,0) 
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where  G(F4,0)  is  the  greater  of  F 4 and  0,  and  F 4 has  the  range 
-®to  (X4^  + Y*^)  . Consider  the  case  where  gyro  No.  4 has  not 
failed  and  simply  has  noise.  Then 


dxtdY* 


* * * * — l4Ui4  e 2 * x* 

dx4dY4  • *<x*,Y*>  - '2,vo-y- 

4 4 


1 lX*A  Y* 
TT  ' + 


0 


Y* 


= 2R 


2 2 
de  dR  e_R  /QR 

2n  o 2 

R 


where  oR^  = 2 o^*  = 2 Cy*  = and  R^  = X^  + . Then 


-R 


<MF4)dF4  = 


If 


2R  d6  dR  e dF4 


R">G(F4,0) 

F 

L 

0 

= dF,  • e r 


2tt  0 2 
R 


/dR 

o 2 0 2 • 
R r 

R>  G(F4,0) 


a 1 
r 


-R 


p?  + -V) 

\°r  ar  / 


-G  (F4,0)  • 


= dF4  • e 


<v-o 


(A*  A) 

v R r ' 


dF4  e-F4/5/3°N' 
7 


7/3  °N 


dF4  e+  Vi  °N2 


if  F„  > 0 
4 


if  F . < 0 
4 


(10) 


o..2 


7/3  UN 
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The  probability  of  false  alarm,  PFA,  using  test  level  e2 
against  is 


PFA 


-F 4/5/ 3 on2 
e 


5 

7 


e 


3 

5 


2 


\ 


(11) 


If  °N  = • l°/hr  and  e = .5°/hr  then  PFA  = 2.  x 10~7. 

Raising  e to  . 6 °/hr  reduces  PFA  to  PFA  = 2.6  x 10-10.  The  frac- 
tion of  false  alarms  to  actual  failures  is 


(MTBF) 


MTBF  = Mean  time 

before  failure 

A = Test  smoothing 
s time 


For  MTBF  — 3000  hr,  Ag  — 1./60.  hr  we  see  in  the  last  example 

with  e = . 5 °/hr  we  have  f = .036  and  withe  = ,6°/hr  we  have 

fr„  = .00005. 

FA 

Consider  the  case  of  failure  of  gyro  No.  4 having  occurred 
where  the  distribution  of  failure  magnitude  is  <f>(Df)  and  the 
distribution  drift  direction  is  flat  with  respect  to  angle  Gp. 
The  probability  distribution  of  X4 , Y*  is 


(X4-DFCb) 2 

V2 

X4 

dX*4dY* 


- <MDp) 


dD 


F 
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assuming  (X*  - X4) , (Y*  - Y4)  are  normally  distributed  where 

X4  = DfCq  , Y4  = DfS6^.  Using  o**  * = oy*2  = or2/2, 

F 


2 2 2 
R - XJ  + y4 


♦<x$.»J>  dx;dY« 


dX«dY« 

TT  O 2 

R 


R 


R 


-dt 


o 2 
R 


df=o 


4>(DF)dDp 


de 


F 
2 u 


where 


(12) 


2D, 


2D„-R- 


u “Tl  ( 


| c C 

+ Q Q \ 

(x4  ceF  y4  seF)  o 2 

V 9 9f 

6 V 

v _ 2Df-R. 
. ) " o 2 


c0f-0 


dfr 


using 


X*  = R co  , Y*  = R Sft  . Except*  in  rare  cases  K = 2 — =-  »1. 


Then, 


27T 

h 


df=0 


d6F 
2 tt 


<f>=0 


K 


KC.  d4> 

e * 2i 


2tt  00 

f-K(i-c^)  r 

= eK  • >|i-.  • J 

4>  =o  211  -® 


2 d$ 
2ir 


?_t2/2 


/.W-.2’ 


Dfr 


R 


y 2ttK  t=0  n/2tt  >/2ttK 
♦Cases  unimportant  to  non-detection  of  failure. 


R 


27*07* 


(12a) 
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Substituting  this  result  in  (12) , obtain 


(r~df) 


* * * dXA  dYI 

dx<dY<* ■ 


CO 

r 

0 2 

> dD 

fe 

R 

4>(Dp)  F 

ti 

0 

2 ♦ 2 +2 

where  R = X4  + Y . Substituting  (13)  into  (9)  obtain 


4>(F4)dF4 


[[  «:«:  • e 

R / 

Jj  2tt3^2  aR  \fp~ 

J 

R - G(F4,0) 

df= 

co  (DF~R) 
o 2 
R 


dDr 


vD_ 


Changing  variables  of  integration  X*,  Y*  to  R,  0 using 


dX*  dY  * 

4 4 = R d6  dR  = fc  dR  d§ 

2*3/2CR^~  2»3/2orv«^"  °r  2,1 

and  noting  that  the  integrand  does  not  involve  6 , 


4>(F4)dF4  = J (v/G(F4,0)  ) 
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4/0  2 


r 


r 


(14) 
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where 


J(Y) 


CD 

I fk dR 

I V 77  0R 


R=Y 


R 


e R 


. (Cp-R) 


J 


°R2 

e K 


dDp 


DF=0 


*<DF>  7= 

V df 


Consider  the  probability  of  non-detection  of  a failure, 
2 

using  the  test  F4  >£  in  which  case 


< 

■/ 


PND  = 1 <(>(F4)  dF4 


t,  ” 

j 4>(F4)  dF4 


0 


Using  (14) , and  integrating  by  parts 


j 


4 

2 

R 


^ J(Y)d\e  r 

y=o 

t 2 

Jltl’e  r -J{0) 


+ I 


Y-0 


Dp=0 


H dD£ 


-G  ((Y-  t 2 ).o)  _ 


<df-Y 


(W 


2 * • 2 


dDp 

*,df>  -T—  (15) 
/»p 


on  collecting  integral  forms  J{£),  J(0). 


PND, 


1-17 


403314 


Consider  the  case  of  a distribution  of  failure  rates 


<MDf)  = l 


where  X = 


(X 


3/2  - D 3/2 
FL 


r 


XsT D for  D < D < D 

F fl  F Fu 


0 otherwise 


The  distribution  is  rather 


flat  with  bias  toward  higher  values.  Since  non— detection  occurs 
mostly  in  a band  of  Dp  values  less  than  wide  at  the  lower  end  of 
of  the  distribution,  consider  the  probability 


D„  + ° 

fl  n 


(V  S(\  + °»))  "/ 


dD, 


.La) 


3/2 


-1 


2u  r, 


172 


where  u = DFl/cn,  rD  = DFy/Dj^.  For  u = 11,  rD  = 10,  the 

probability  is  4.5  x 10~3  for  occurrence  of  D„  value  where 

F 

non-detection  is  modeled  as  practically  possible. 
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For  R < Df  -oRf 


normal  function.  Substituting  (16)  into  (15),  obtain 


assuming  Dp  -e  » crD,  that  is,  c , the  test  level  is  many  noise 
rL  K 

sigma  less  than  the  failure  rate. 
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The  exponential  terms  dominate  variation  of  the  magnitude 
of  the  integrand  where  appreciable  contributions  to  PND  occur. 
For  the  tetrahedral  case  = a ^ = -j  hence  for  y,  e » 


/ -g^2-e2  ( 

,y  *2  \ 

_(VY)2  1 re*_2(yJ^)  v^i 

( \ ° 2 

/ 0 2 ) 

0 2 ttL  V 2 > fl  J 

\ r 

r / 

R r 

\e 

e / 

* e = e for  y>e 

* (y_DF)2 


= e 


for  y < e 


(18) 


The  maximum  of  this  function  occurs  at  y = Dp  /2  when  e £ °FL/2 

and  at  y = ^ when  /2<e<D  hence 

FL  FL 


y 


max 


It  is  desirable  to  use  the  least  e,  so  as  to  minimize  PND, 

consistent  with  acceptable  PFA  which  by  (11)  is  c>5.5  a . For 

ill  then  £ <Dp^/2  using  e = 5.5  Gjj  and  the  integrand  of 

(17)  is  approximately  maximized  at  y = Dp  /2.  When  DFl/^n  >11, 

we  model  GF2  failure.  In  general,  (17)  is  approximately 

evaluated  setting  y in  non-exponential  terms  to  y = Dp  /2  where 

y > e and  y = e where  y<e  , and  integrating.  Then,  fore<Dp  /2, 

L 


obtain 
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where  G(x)  = 


is  large  for  the  GF2  failure  model. 


Note,  since 


using  the  assymtotic  expansion.  Modeling  r - D /D_  » 1 

D FU  FL 


then  A 


3/2 


' \) 


3/2.  For  cases  where  c<  D /2 , 

FL 


PND  = 


2U2  • rD3/2 


(u/2-v2) 


3 2 

- | ( u— v)  2 


(20) 


where  u = Dp^/aj^ , v = e/a^.  Adopt  a nominal  value  of  rD  = 10, 

noting  adjustment  of  PND  is  readily  made  with  any  change  of 

assumption  regarding  rD>  Consider  the  marginal  case  for  GF2 

failure  with  u = 11  where  v = 5.5  to  hold  PFA  to  an  acceptable 
— 8 

level,  PFA  = 10  obtaining 


PND  = 1.3  x 10 


-4 


50 


-45.3  . ia 
e + . 18 


.-45.3. 


- 

5 _ 
~10” 


24 


GF-  Failure  Model  e = D_  /2 
2 FL 


= ll.o. 


N 
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When  u = DFl/on  < li  and  v = e/oN  =5.5,  since  e > DF  /2  the 
maximum  value  of  (18)  is  at  y = £ . Substituting  y = e for  non- 
exponential terms  of  (17)  and  otherwise  making  the  same  approxi- 
mations as  in  (20),  obtain  for  e >D  /2, 

Ft 
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Consider  the  statistical  properties  of 


2 2 
F = T + T 

0 X12  13 

+ T 2 + 
1 23 

T 2 + 
X14 

Using  (6c)  , 

T142  + T242  + T342  = ( 

' X4 

i X1  2 

nT 3 

-y4  — 

+ (x3  + 

X4)2 

= 1 

(_l 1 _ ^2 

V \r2  \r2 

+ (x3  + 

X4)2 

= 1 

L!i  _ h 
^ \r2  \^2 

-71: 

2 2 
’ + T 

24  34 


\T 2 / 


+ (-  ^ + ^ + h) 

' \f2  \f  3 nT3  ' 


where  the  i 


identity  U^2  + ~ 2 + ^ J~L-^  + aU3j 


is  used  with  a — l/»/2 , 1/^3  to  isolate  y^,  x^  to  single  terms  to 
remove  correlation  of  variables.  Introducing  the  variables 


x x X1  x2  2 

x = — - — , x = — + — with  variance  o„  . 

D nT 2 "/  2 s n'2  V2  N 


2 2 
T + T + 
14  24 


T342  - (Xs  +^T  y4)  + (^  +/|x4  *J1x3) 


where  correlation  of  variables  due  to  x^ , y^  was  removed. 
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Y i y o x i y 9 

Where  we  also  introduce  variables  v = — - — , y = _ + z 


y- 


then  by  (6c)  , 


\r 2 \2  S 42  \r2 


2 2 2 
T +T  +T 
12  x13  1 23 


S */!>„)'*  *»,*»>  4 


2 


+ 


[-* 


. „ . , e 


] 


+ 


2 


using  the  above  identity  with  a = 1/42.  Adding  the  two  results, 
and  introducing  the  variables 
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obtain 


F0  - X42  + V42  + V32  + “ 


where 


4ilxD\7f)  + Q' 


^ + y ^ 
2 yD  2 


)'  -0  -fl  'J 


.'10 


( 

rr  3 7 [J 

w * d + r 

3 ) 

+ w 

6 x3  + 2s/-5  Yd  6 J5 

*D'  \ 2 J 

2 yD/ 

= u2  + X32 

using  ot  = J"|  in  the  identity,  then  collecting  terms.  Note  that 
variables  generated  by  the  identity  have  a covariance 


U 


= (aU.  - V l“  - a z U0 ) (7l  - a U,  + aU, 
12  1 2 1 


= a\'l  - a2  |ux2  - U22)  - 


(1  - 2a2)  ' U,U 


12 


In  the  case,  l^2  = U22  then  the  new  variables  are  uncorrelated 
using  ot  = l/\[2  . Since 


V 2 = Y 2 = 5.  o 2 
* 4 ‘3  2 N 


we  may  apply  the  identity  with  a = l/\r2  to  obtain 


2 2 2 2 
Y4  + Y3  - °4  + U3 
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where 


U„  = 


U„  = 


J~  3 

2 


nT3 

2 


(y4  + y3  + y M2)  + 


(Y4  ' y3  - 


2/2 

3 x 
s 

2/2 


and  U4  • U3  - 0.  Also  note  are  uncorrelated  with  X., 

x3,  U. 

Note,  X4  “ 2 °n  ' U = Tp  °N2*  To  use  the  identity  to  form 
uncorrelated  variables  when  the  variances  are  unequal,  use  the  fol- 
lowing general  result 


a = 


- y/iT 


X = 


Ul2  - U22 


2 BlU2 


A = 


Where  x4 , Uj  - U then  U, U_  = X.U  = o //5  so  obtain 

1 . , 2 rr^ o .rc  1 1 4 N 


then  a = -,^1  - a2  = 


4/5  3'V *  * " 3 

The  new  independent  variables  are 


V1  = 


V2  = 


'ta x° ' 71 x« + f/t  *3 

11  XD  * j-  yd  +/?*4  + tTt  x: 


3/15 


where  * V2  ® anc*  x4  + + V ^ . We  know  V^,  V_  are 

uncorrelated  also  with  U3,  U4,  but  must  determine  correlation 
with  X3  to  obtain 


V1X3  - 0 


V2X3  - V5  °N2 
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The  only  non-zero  covariance  is  V2X3  which  is  removed  using 
the  identity  with  U1  = V2,U2  = X3  using  oX32  = 21/10  °N2, 

°y ^2  = 29/10  for  which  X = 4/3  to  obtain  a = l/v'10, 

/ 1-  <>■  2 = 3/VlO  hence 


U,  = x,  - 

1 6vr3  3 


D . 1 17 

X4  XD 


2\l2  2v3 


6\'6 


„ 3 ^ 3 ,3  j_  3 

U_  = x.,  + y + x . + x 

2 2\I3  3 2\r2  D 2\f3  4 2-76  D 


where 


U1U2 


2 2 2 2 
0,  X3  + V2  = U3  + U2 


Collecting  results. 


F0  * T122  + T132  + T232  + T142  + T242  + ^ 


2 2 2 2 2 

= ux  + u2  + u3  + u4  + v1 


where  the  variables 


U,  = — 

1 6^3 


x3  ‘ 


D 1 .17 

— + x . + xn 

4 „ r>  D 


2nT2  2\f3 


6n/6 
+ 3 


„ _ _i_  x + 3 v + -JL  x 

U2  2/3  3 2/2  Yd  2n/3  4 2/5  D 


U- 


u, 


= 


(y*  - y-,  - y^/\T2)  + 


2/2 


f3 


= 2 (y4  + y3  + ys^2>  + 


2'^2 


2/2  /2  1 

V,  =■=■/■=■  x-,  - + hr  x.  - x^ 

1 3/3  3 / 3 4 3/3  D 
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are  uncorrelated  where 


2 

°B  30 


Since  ot 


rs 


XD  = 

(X2-X2 

xs  = 

<YrY2 

yd  = 

(YrY2 

Ys  = 

(Y1+v2 

Y r = 
r 

1,  4 

2 

oU^ 

= 2oN 

au22 

" 3on 

au32 

‘ 3on 

au42 

* 2V 

aUj^2 

= 2°n 

' ~0  = 

12on2 

for  the  new  independent  variables. 

Consider  evaluation  of  the  probability  distribution  of  Fg , 
which  involves  the  sum  of  independent  Rayleigh  distributed 
variables  with  differing  means.  First  consider  the  case  where 
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means  are  equal.  It  may  be  shown  that  the  probability  distribu- 
tion for  the  case  of  sum  of  two  and  three  Rayleigh  variables  with 
equal  mean  is  Distribution  of: 


-S2/M2 

<MS2)  dS2  = —^2  S2  dS2 
M2 

-S3/M3s  2 

«<S3>  dS3  * ^3  ’ 4-  dS3 
M3 


Sum  of  Two  Rayleigh 
Variables,  Means  M2 


Sum  of  Three  Rayleigh 
Variables,  Means  M^ 


Let  S2  = U22  + U32  where  M2  = 3aN2  and  S3  = l^2  + U42  + V^  where 

M-,  = 2a  2 . Then  F_  = S-,  + S,  has  a probability  distribution 
3 N 0 3 3 

given  by  integrating  the  product  of  the  two  distributions  with 


substitutions  dF^  = dS^, 


s2  * F0  **S 3 


♦ (F0)  dF0 


CC 

/ 


s3=o 


-<F0  - S3I/M2  " S3/M3 

'F0  ' S3>'  S32  dS3dF0 
e 2 3 

2M2  M3 


dF , 


2M, 


F0//M2 


M. 


where 


I = 


r 


-ax  . 2, 

e (Fq-x)x  dx 


“ («3  " »2  ) 
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It  may  be  shown  by  integration  and  taking  JM0  = 3o  2,  m,  = 2o  2 

£ N 3 N 

that 


4>(F0)  dF0  = 54  [2  (u-3)  e"2u  + (u2  + 4u  + 6)  • e 3u]  du 

where  u = FQ/6  aN>  The  probability  that  noise  causes  FQ  to 
exceed  e2  is 


a 

P<F0>E2)  = J2 


*(F0)  dF0 


= [-27  ( 5- 2u)  + 2 (68  + 42u  + 9u2)  e_u  ] e“2u 


where  u = 1/6  (e/aN)  . 
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2 . Failure  Detection  and  Isolation  Algorithm  for  Tetrahedral 
Array  with  Three  Valid  Gyros 

When  one  of  four  gyros  in  tetrahedral  array  is  invalid,  say 
gyro  No.  4 then  9^  in  (5)  must  be  estimated  using  data  of  other 
gyros  using  (3),  hence 

e2  - ! k22  ♦ a„2  ♦ e142] 

= 3 [012  + 813  + (ei3  " ei2*  ] 

* J [0122  + 0132  - ei2013] 


The  test  function 

F1  = 3 [T12  + T13  ~ T12 " T13  ^ 

) 

2 

correctly  estimates  Dp  if  only  gyro  No.  1 drifts  and  at  drift 

* 1 

rate  . When  a gyro  other  than  gyro  No.  1 fails  it  is  important 
that  the  test  function  for  gyro  No.  1 be  minimized,  in  order  to 
isolate  the  failure.  This  may  be  done  by  elaborating  the  test  to 
the  bilinear  function 


F1  3 


12 


+ T 


13 


- T 


12 


13 


- T 


23 


’[“I 


T + 
12 


K, 


T + 
13 


K 


2 ‘ 23^ 


(22) 

2 

which  correctly  estimates  Dp  when  only  gyro  No.  1 drifts  since 
T 22  = 0*  Constants  K^,  K^,  K ^ are  chosen  to  minimize  if  either 
gyro  No.  2 fails  or  gyro  No.  3 fails. 
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Consider  the  case  only  gyro  No.  2 drifts.  Then  (22)  reduces 


to 


F = — 
1 3 


T122  * K1T23T12  - K2  T232 


(23) 


Using  (2)  it  may  be  shown  = 1/2,  hence  when  gyro 

No.  2 drifts  in  a direction  with  angle  <p  ^ from  e*Ti2'  we  have 

T12  = ~DF2C(t>2  and  T23  = DF2  C60°- <j>2 

When  only  gyro  No.  2 drifts,  it  may  be  shown 


4 2 2 

F = - D ^ r + K.  C.  • C 
1 3 F2  *2  1 <*>2 


60  - 4>2  K2  C60°-  <t>2 


f°F  2 

2 


(J  + X - K2  ) + D • C 


2 <J> 


2 ~ A 


(24) 


where 


D = 


CA  - 


SA  = 


^ (K]_  - K2)/D 


The  worse  case  direction  of  drift  <j>2  is  <J>2  = A/2  for  which 

F is  maximized  to  w 

k2*  h-  d 

* XN1 

where  K2  = 1 + -±  - K 


2 2 
F1  “ 3 DF2 
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Eliminating  K2  show 


d =vT 


2 * 3 2 

(1  + Kx)  +(K2  - 


so  F is  a function  of  K^,  K2*.  Note  is  minimized  taking 
= -1  in  which  case  (11)  reduces  to 


F 


1 


(25) 


For  the  worse  case  direction  of  drift  $2=  - A/2  it  is  readily 


shown 


U) 


Fi  * df. 


WS 

the  equal  sign  holding  for  K2  £ 3/2,  which  is  desirable  to  hold 


done  worse  case  F 


1 ' 


Measuring  drift  rate  direction  relative  the 

= 1 -2  S 


worst  case  direction  with  9 = <p  -A/„  note  C_.  . = C_ 

2 2 2 2<*>2~A  2 q - 

hence  (25)  takes  the  form  " 


0. 


r,  2^2 

F1  ■ 3 DF2 


= dt 


★ 

K2  + 


3 * 

I " K2 


(1  " 2S, 


4 3 * 

1 “ 3 (2  ~ K2  ) 


for  K * < 3/2. 

* * 

Then  F ^ is  seen  to  be  minimized  by  making  K2  as  large  nega- 
tive as  possible  (noise  being  the  counter  consideration)  . Since 
1 * 

K2  = ~2  ~ K2  ' :’'t  follows  K2  should  be  as  large  as  possible.  Note, 
with  K^=  -1,  generally  A = -60°  so  the  worst  case  drift  direction 
is  4>_  = -30°  , that  is  90°  to  eT 

23 
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For  only  gyro  No.  3 drifting,  the  same  relations  hold  except 
for  sense  of  T23,  T^3  so  = 1. 

The  derived  algorithm  is 

F1  * I T122  + T132  - T!2  ' T13  - T23  ' [T13  ‘ T12  + K2  ' T23l  1 


which  has  properties 


if  only  gyro  No.  1 drifts 


i i-j  <!  + k2>  se22 


if  only  gyro  No.  2 drifts 


l-f  (l  + k2)  s032 


if  only  gyro  No.  3 drifts 


where  K2  is  as  large  as  consistent  with  noise  levels.  To  investi- 
gate the  behavior  of  in  the  general  case  where  all  gyros  drift. 


Tl2  ' °F1  C*1  ‘ °F2  ’ % 


T13  ~ \ C6O»-01  + Df3  C03 

T23  = °F2  C60°-(j)2  + DF3  C60»-( 


<Pi  is  the  angle  from  e_  to  D„  about  e„ 

X T12  F1  S1 


<$>2  is  the  angle  from  e to  D about  e( 

12  2 


4>  is  the  angle  from  e^  to  D_  about  e„ 

3 T13  F3  S3 

as  seen  in  figure  1-1. 
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Figure  1-1 
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Note,  Eq  (26)  may  be  put  in  the  form 


F1  "I 


[T12  + T13  + T23  )+(T-  ' + T — 


12  *13  T x23l 


4 2 

K • T 
3 1 23 


(28) 


where  K = K2  + 1,  where,  using  (27) 


(T12  T13  + T23) 


“ DF1(C<t)1  C60°-(t>1)  " DF2(C  <t)2'C60o-'t>2)  °F3  (C  ^3  C 


60 °-  0. 


<T122  + T132  +T23> 


-D  . S 

1 03^-30' 


+ D S + D S 

2 <p^-30  ° t 3 0^-30  0 


D 2 ■ (1  - S 2 ) + D 2{1  - S 2 ) 

F1  12  ^1-30°  F2  2 *2  -30°' 


+ Dr 


(I- v2  )- 


3-  30 1 


■2  D D C C 
F1  F2  *1  *2 


+ 2Dp,Dr.  «=„.  . c -+  2 Vf3C^%>%3 


1 3 6O°-0,  4>3 


using  (C*  - C60..,)  = -S0.3O.  and  (C^  + c„ „2  a)  = 4 
Then 


'0  6O°-0'  2 ^0  -30' 


^T,  2 + T,  2 + T^2  ) + (?,  g‘T,  „ + T, 


12  13 


23 


12  13  23 


)2 


D 2 + D 2 + D 2 

*1  2 F3 


“3  °F  °F 
1*2 


'12 


'I  %%  ‘ *13 


+ 3 DF2°F3  * *23 
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where 

12  C<})1  <J>  2 ^1-30°  ^2-30° 

13  60°-(})1  <P3  ^1-30°  ^ 3-30 ° 


6l-30°  62-30°  61  +30°  \ +30° 

s«  cft  + Cfl  Cfl 

yi  ° 3-30  ° 1 + 30°  3 + 30° 


23 


= C 


60°-<J>o  60°-4> 


+ S 


2-30° 


30' 


C ri 

2 + 30°  3 + 30° 

(29) 


using  <t>  = 9 0 noting  e?,e..  are  angles  measured  from  worst 

IT  J U ^ J 

case  directions  in  terms  of  which,  using  (27) , 


= Dp  • Cfi  -D  • CQ 

12  F1  y 1-30°  F2  °2-30° 


T,  - = Dp  • Sfi  + D„  • Cfi 
13  F1  G1  F3  ° 3-30° 


(30) 


t23  ■ DF2  • S6j  + DF3  • Se3 


Then,  in  general 


+ Dt 


+ Dt 


X 


23 


+ K 


(31) 
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where  by  expanding  cosines 


( 32) 


-C 


3-63 


+60° 

1 


+ 


1 

4 


x23  - Ce2-e3'J  S02+s3  + 3O» 


-(* 


Ce2+60°  C03  + 6Oo+2  S02+6OoS0 


It  may  be  shown  | A 12|  < 3/2  , | *13|s3/2,|  A23|  <3/2. 


Note  the  phase  of  cannot  maximize  A^2  with  0^  = 0,  180° 

for  02  = 62  and  maximize  A13  with  0^  = -60°,  120°  for  03  = 63 
simultaneously,  rather |A12  M»i3|‘Vt7 

The  selection  of  K should  at  last  be  held  so  if  gyro  No.  1 
fails,  the  noise  level  in  terms  of  Dp2  Dp3  does  not  reduce  the 
apparent  failure  magnitude  by  more  than  a fraction  E on  average. 
This  occurs  when 


(1-e)2  Df2  = F;l 


• a 


2 


N 


for  which  K = | e D 2/a  2 

^ r N 

In  theworst  case  when  noises  of  gyro  No.  2 and  No.  3 are 
equal  and  02  = ©3  = V2, 


3 2 2 

K = 8 £ °F  /°N 


(33) 


would  be  necessary  to  hold  the  apparent  failure  rate  reduction  to 


e • Dp. 


3 + 60° 


1-38 


403314 


The  apparent  failure  magnitude  can  also  be  reduced  by  the 
terms  ^13'  ^23  worst  case  phase  relationships  subject  to 

(32)  so  it  may  be  shown  the  worst  case  reduction  factor  in 
apparent  failure  magnitude  is, 


£ i 


2\[l  °N 
3 D„ 


The  total  reduction  in  apparent  failure  magnitude  from  the  K term 
and  X terms  of  (31)  is  ( e + e *)  Dp  which  may  be  compensated  for  in 
testing  by  lowering  the  test  level  accordingly. 

The  derived  algorithm*  tests  Fr<6  r = 1,  2,  3 where 


F 


1 


F 


2 


- a 

- a 


12 


2 


where 


F4  * 


2 

3 


12 


+ T 


13 


+ T 


23 


+ (T 


12 


- T 


13 


T23} 


a 


(1  + k2) 
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If  a 

single  test  fails 

, say  F^*  ^ <5  then 

the 

gyro  No.  r* 

is 

concluded 

/ 

to  have  failed. 

The  functions  F 

r 

have 

the  properties: 

« 

\2 

if  only  gyro 

No- 

1 drifts 

Fl=< 

°F2 

' 1 1 se22! 

if  only  gyro 

No. 

2 drifts 

(35a) 

• ! 1 • se3  ! 

if  only  gyro 

No. 

3 drifts 

Dpi2 

‘I  1 se12  j 

if  only  gyro 

No. 

1 drifts 

F2~  i 

°p22 

if  only  gyro 

No. 

2 drifts 

(35b) 

•! 1 -“s63*2! 

if  only  gyro 

No. 

3 drifts 

F,=  <D 


1 '“S0X*  ( 


1 - a S, 


7*  I 


where  0^*  _ 0^  + 60°,  0^  being 
zero  for  drift  normal  to  e 

T 

13 

if  only  gyro  No.  1 drifts 

if  only  gyro  No.  2 drifts  (35c) 

if  only  gyro  No.  3 drifts 

where  = 0^  + 60°  and  02*  = 02  +60' 


6 •,  * , 0O*  being  zero  for  drift 
T 

12 


1 ' ”2 
normal  to  e 


★ 

Which  amounts  to  testing 


relative 


(F4-6)/a 
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The  variation  of  due  to  noise  of  other  gyros  when 
gyro  No.  r failed  is  limited  to 

6f4  " °F  * °N  if  6N  «°F  (36) 

r r 

is  the  noise  amplitude  and  worse  phases  of  the  other  gyro 
N 

drifts  occurred  (by  (31)  with  K = 0) . Writing  the  algorithm  (21) 
in  the  form. 


Test 

No  . 

1: 

T232>6* 

If  only 
failed 

Test 

No  . 

2: 

T132>6* 

If  only 
failed 

Test 

NO. 

3: 

T122>6* 

If  only 
failed 

Test  No.  1 fails  the  gyro  No.  1 

Test  No.  2 fails  the  gyro  No.  2 

Test  No.  3 fails  the  gyro  No.  3 

(37) 


where 

6*  = (F4  -6)/a 

Consider  the  case  when  two  of  the  tests  fail,  say  Test  No.  1 
and  Test  No.  2.  This  can  occur  when  only  one  gyro  actually  failed, 
say  gyro  No.  1,  as  seen  by  (35a) , (35b)  if  S sufficiently 

small.  Deciding  which  gyro  failed  may  use  (34)  to  compare  F1  and 
F2«  If  Fi > Fj  then  it  is  more  probable  that  gyro  No.  1 failed 
than  gyro  No.  2.  The  exact  probability  depends  on  noise  level  of 
F1~F2  whereby  (34) 

Fl-F2  = a(T13  “ T2 3 ) 
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Using  (17)  and  the  general  relation  (ca  2 - S 2 

43  \ 3 "3°  °3 

— C2g  _3o»'  consider  the  statistic  A, 


)■ 


A = T 2 - T 2 

13  1 23 


KiS  + DF3ce3-30»)2  - (D 


s + DP  S 
F2  92  F3  9 3 


V 


38) 


°F1  S01  + 2 DFlDF3S0lCe3"3O°  + °F3  * ^ C29 3~30 ° 

- D 2S  2 - 2 D D S S 

F2  9 2 F2  F3  92  6 3 

If  gyro  No.  1 failed  at  angle  0^  and  other  gyros  have  only  noise, 
the  mean  value  of  A is 


A1  ■ S0]2  -°N2/2 


(39; 


using  C2  = S2  - 1/2,  C = S = 0,  Dp  2 = Dp  2 = o*  . If  gyro  No.  2 
failed  at  angle  02  and  other  gyros  fiave  oniy  noise,  the  mean  value 
of  A is 


+ °N  /2 


(40) 


2 2 2 

using  also  D = D_  = oM  . 

F1  F3  N 


/ 
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If  gyro  No.  1 failed  at  angle  0^,  using  (26) 


Denoting  drifts  of  other  gyros  as  noises  N2  / N^, 


o ^ 
N 


(4-\2  s')2  ■[-" 


2sfi2  +n2-^c,,  + 2n  d s6  ce  -2N2N3se  se 

2 ®2  32  263-30*  3 F1  1 e3-30“  2 3 °2  B3j 


= N24  • S4  + N34  • | P * 4 • N32  . C2  + 4^  n22  • i7  • T7 


since  none  of  the  cross  product  terms  contribute.  Using  * 
N24  = N34  = 2 crN4,  S4  = 3/8  then 


*An  amplitude  distribution  of  two  components  which  are  normally 
distributed  is  modeled. 
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Hence 


„ 2 , 2 

°A1  = 2 °N 


Tn  2 c 2 $ 21 

LDFl  S61  8 °N  J 


If  gyro  No.  2 failed  at  angle  02, 


2 — 2 
°A2  = (A"  A2>  - 


= [(fl  + D 


2 e 2 
F2  ' *2 


)- 


“ (A+  se22)  2 -( 

’ (4+DF2se2) 


S2  + DF22  S02 V %2-> 


2 e 2\  2 A 

F2  se2  ) - 


Denoting  drifts  of  other  gyros  as  noises 


C 2 V 3 ■" 3 0 ° + 2N1N3  S'1Cu3-30°  ~2  df2N3S->2S ... 


’I4  • »4  * >,4  • | ~2 


- H,'  • S'  ♦ N,’  • f C‘  ♦ 4 Kl2  N32  S2  - C2  + 4 Dp  2 S..  2 N.2  F 


F,  -,2  "3 


= 2 y 


»2K!  -v-iv] 


Hence, 


°A  = 2 oN- 


h 


Se/  + 


i a 21 
8 N J 


(42) 
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2 2 

The  observable  A = T13  - T23  is  approximately  normally 

distributed  when  the  failure  term  exceeds  the  noise  level  accord- 
ing to  probability  density 

7 2 


-ifrr1)' 


<t>  (A) 


/2Fc 


if  gyro  No.  1 failed 


i/AiM2 

-2\°A2  / 


$ (A)  = 


if  gyro  No.  2 failed 


(43) 


To  investigate  the  maximum  probability  density  for 

T 2 

x = Dp  Se  put  (43)  for  gyro  No.  1 fail  in  the  form 


S °ei 


i 4° 

- 4? e 


where 


= ( 4 - AH  + ln  (O.  2)  . using  (39),  (41) 


\ /2 


a = 2 a 

z N 


(x  + I V> 


Note  Q = 


f 1 + in  2 a 2y 

2°„2y  N 


N 


where  y = 


6 = 


x + I °N2 


4 + ¥ V 


(44) 
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Since  <P  (A  ) is  maximized  when  Q is  minimized,  take  dQ/dy 
to  obtain 


= 0 


0 - -JU  + y - 


’N 


N 


so 


y = o 


N 


i+v: 


l 


+ (Vo/)  J 


(45) 


Since  >o,  consider  only  the  positive  root.  For  6 »c  note 

y = <S  . For  A >3/8 


y = S+I  °N%  - °u 


that  is 


1 

2 


x = A + ^ o„“/(13/8  + A/oigi) 


N 


(46) 


minimizes  Q and  maximizes  0(A)  when  A >0.  The  probability  density 
for  x = A approximates 


1 

4 


N 


Max  0 (A 


°F  se 
Fi  ii 


#1  fail)= 


(-  ¥ °»2) 


V2*  2on2  <a  + I °N2  + J oN4/6)'i'8 


3 2 

°N 


(47) 

For  the  same  A observation,  A > 0 , if  we  assume  gyro  No.  2 
failed  we  have  using  (43),  (40),  (42)  and  redefining  x = D 2S  2 

F2  6 2 

1 


0(A)  = 


“I  Q 


n/ 2tt 
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where 


Q = 


(fl  - M2  + 


O 


2W  tn  2on2- 


£n  ^oA  j=  0 ■ • + an  2o„  y 


o 2 

2°n  y 


(48) 


where 

, 9 2 

y = * + i v 

6 = -a  + ^ on2 

Since  (48)  and  (44)  have  the  same  form  except  6*  replaces  6 

the  solution  (45)  for  the  maximum  density  holds  with  6-*- 5*  pro- 
9 2 

vided  y > -g-  (since  x >0)  hence 


-1 

/ a \ 

- °N  [-1  + - 

/l  + (6*/on2)2 

= 6*l+o  2 • 

1 1 N 

1 N -1 1 

\ 2 6 * / 

if  j 6*|  > o^2,  which  by  (48)  requires  A>^  o^2.  For  cases 

\ °N2  > A >0'  where  I 6*l  < 8 ” N 


15  2 

o..  let  us  examine  Q and  its  deriva- 


tive using  (44)  with  6 -*-6*, 


Q = [y  " 26*  + 

2o  L 
N 


+ In  y + in  2o 


N 


2on  l y J 


dQ 

2o 


Try  y = o o the  minimum  value  of  y for  which  x>0,  obtaining 

o N . ^ 

2 / „ 4^ 


Q 


(3  2 \ “ / g ^ 

4 “ 3 U)  + *n  U °N  ) Where  U = ^2 


(50) 


dQ  _ 25 


dy 


18a 


N 


[x  - (A  u)  ] 


N 


1 °N  > A>° 
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Since  we  consider  the  case  u = — — <1, 

15  15  o 2 

N 

dQ 

>0  and  that  Q is  larger  for  values  of  y = ^ a ' 
ity  density  for  the  most  likely  value  of  Dp £ S0  2 
failed  is  by  (50) , (48)  2 


Max 

°F  Sfl 
F2  02 


Max 

DF  s0 
2 2 


<J>(A  No.  2 fail)  = 


1 


-H: 


'/2' ! v 


(A 


°N2 


13 

8 


No.  2 fail) 


/ 


2 TT  2 0, 


N 


A-^  o 2 
8 N 


it  follows 

The  probabil- 
if  gyro  No.  2 


i V>A>0 

(51) 

A > j °N2 
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3.  Calculation  of  the  Probability  of  Isolating  a Gyro-Failure 
in  the  Three  Gyro  Case 

When  only  one  edge  test  clearly  fails  in  the  three  gyro  case 
it  is  clear  that  one  or  the  other  gyros  associated  with  the  edge 
test  that  failed  was  a failed  gyro.  The  best  that  can  be  done 
is  estimate  the  probability  that  one  gyro  failed  rather  than  the 
other,  on  the  basis  of  the  three  test  values.  The  principle  by 
which  this  is  calculated  here  is  the  relative  probability  densi- 
ties of  the  test  results  for  alternate  hypothesis  of  failure,  the 
probability  densities  being  those  for  maximum  liklihood  values 
with  respect  to  amplitude  and  direction  of  the  hypothesized  fail- 
ure rate.  This  procedure  then  is 

Max  4>  (A|#l  Fail) 

!fi  (Vh) .1 

PF0  Max  4>  (A  I #2  Fail)  r 

{W) 

where  Pf-^  + Pp2  - 1 so  Pp^  = , Pp2  = 1“PF-^  where  (34)  , (38) 

are  used  for  the  peak  probability  densities  for  given  A h (t^ 32-T2 32 ) 
when  T^2  failed.  Using  (34),  (38)  obtain 


P 


1 


1 


1 


+ 


2^2 


N 


for  A > j oN2 


a 2 > A > 
N 


3 

8 °N 


2 
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A table  of  a number  of  values  is 


A/o 


N 

2. 

3.5 

5. 

10. 


1 

. 52 
. 80 
. 956 
. 99974 


For  values  of  A/oN  <1.5 
because  of  approximations  made 


A = 


13 


2 


6 

the  formulae  are  in  accurate 
in  the  deviation. 
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4.  Navigating  with  Improved  Accuracy  with  Four  Valid  Gyros 

The  proposed  configuration  generates  four  navigation  program 
outputs  in  parallel.  To  minimize  navigation  error  the  parallel 
outputs  x^  of  any  navigation  parameter  x can  be  estimated  by  use 
of  weighting  coefficients,  u>^  , 

4 

2->  (A>.  X . 

A i=l  1 1 

x = “4 

£ “i 
i=l 

where  uk  should  be  selected  according  to  quality  of  the  ith  chan- 
nel estimates.  When  no  failure  has  occurred  and  all  gyros  behave 
according  to  specification,  selection  uk  = 1/4  is  a practical 
selection.  Consider  the  case  of  soft  failure  of  one  gyro,  GF^ 
type,  where  already  available  test  functions  F , r = 1,  4 do  not 
indicate  failure.  In  this  case,  the  use  of 

"i  - [Fj  + Fk  + c] _1 

where  the  ith  channel  uses  gyro  j and  k,  and  C = constant,  will 
reduce  the  weights  on  two  channels  using  the  degraded  gyro.  This 
selection  of  weights  is  further  justified  as  follows: 

a.  For  errors  in  x^  independent  from  channel  to  channel, 
the  theoretical  weight  is  = l/crx^ 

b.  Actually  errors  in  xy  are  correlated  because  certain 
pairs  of  channels  have  one  gyro  in  common.  However,  the 
correlation  of  drift  rates  in  the  constructed  reference 
using  two  gyros  is  |P|  <1/3.  Neglect  this  correlation 
since  the  effect  on  magnitude  is  fairly  small,  by 

y/l  - = .943. 

c.  The  reference  error  of  the  constructed  reference;  using 
two  gyros  has  variance  proportional  to  (°Dj^  + 0Dk^)* 
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2 

where  °Djork  is  the  variance  of  gyro  j or  k.  Gyro 

cluster  orientation  is  such  that  most  navigation  variables 
relate  to  total  reference  error,  so 


o 


X . 
1 


2 


+ 


+ C 


o 


where  CQ  includes  errors  not  related  to  reference  error. 

d.  For  four  gyros,  the  test  function  F-  for  test  of  gyro  j 
approximates  Fj  = Dj^,  when  one  gyro^j  has  distinctly 
larger  drift  than  the  other  gyros,  for  which  F^  is  noisy 
but  small. 

e.  Then 

“i  * 1/0Xi2  * [Fj  + Fk  + c] 
where  C = 

C1 


Note:  This  weighting  technique  is  contemporaneous  to  the  smooth- 

ing time  of  the  test  so  that  if  a gyro  shows  some  recovery, 
the  channels  using  it  are  given  more  weight. 

5.  Preliminary  Gyro  Failure  Detection  and  Isolation  Program 
FORTRAN  Listing 


S(4) 

= 

T2  3 

* T 

i2  3 

S ( 5 ) 

= 

T24 

* T 

24 

S ( 6 ) 

= 

T34 

* T 
^34 

F(l) 

= 

S (6 ) 

+ S ( 5 ) 

+ 

S (4  ) 

S (2 ) 

= 

T 

L13 

★ T 

13 

S ( 3) 

= 

T 

14 

* T 

14 

F ( 2 ) 

= 

S (3) 

+ S ( 6 ) 

+ 

S ( 2 ) 

S(l) 

= 

T12 

* T 

12 

F ( 3 ) 

= 

S(l) 

+ S ( 3) 

+ 

S ( 5 ) 
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F ( 4 ) - 

S(l) 

+ S (2)  + S (4) 

F0 

( F ( 4 ) 

+ F ( 3)  + F ( 2 ) + F(l) ) 

F ( 1 ) = 

<T2  3 

" T24  + T34}**2  + f(1) 

F ( 2 ) = 

<T14 

+ T,  - T1  ^)  * *2  + F ( 2 ) 
34  13 

F ( 3 ) = 

<T12 

+ T14  ' T24)**2  + f{3) 

F ( 4 ) = 

( T1 2 

- T + T23) * *2  + F (4 ) 

v ( 5 ) = 

v5 

TL 

( F ( JB ) -63)  * a 

DO  10 

J = 1- 

4 

IF  (v(5) . EQ. 0. ) Go  to  1 
IF  ( F ( J)  - F0 ) > 0 Go  to  10 
v5  = 0 . 

IF  (F ( 6 ) .LT. 62)  Go  to  7 
2 BAD  = 1. 

SM  = S(l) 

Go  to  4 
7 v(J)  = 0 
JB  = J 


For 
2 BAD 


Four 

Gyro 

Case 
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1 IF  (v(J).EQ.O.)  Go  to  10 
DO  2 K = 1,4 

IF  ( K , LE . J ) Go  to  2 
IF  ( v(K) . EQ. 0 . ) Go  to  2 
L = J + K -1 
IF  (J.EQ.l)  L = L-l 
IF  (2 BAD. EQ. 1 . ) TL  = SM 
IF  (S (L) .GT. TL)  Go  to  2 
IF  (2BAD.EQ.0.)  Go  to  7 
SM  = S ( L) 

JM  = J 
KM  = K 
Go  to  2 
7 KB0  = KB 

KB  = TEN-J-K-JB 
v (KB)  = 0. 

ARG  - S (L) -ARG 

2 CONTINUE 
10  CONTINUE 

IF  ( v5*F0. LT. 0.  ) Go  to  5 
2 BAD  = 1. 
v5  =0. 

Go  to  4 

5 IF  (2BAD.EQ.0.)  Go  to  6 
JB  = 3 

IF  ( JM. GT. 1)  JB  = 1 
IF  (KM.LT.4)  JB  = 4 
v ( JB)  = 0. 

2 BAD  = 0. 

Go  to  4 


For  2 BAD 


Three 

Gyro 

Case 


For 
2 BAD 


Optional 
(Long  Shot 
Case) 


For  2BAD 
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6 IF  (KB0. EQ. 0. ) Go  to  3 
READ  P(ARG)  Table 
v ( KB0 ) = P(ARG) 
v ( KB)  = 1 . -V (KB) 

3 CONTINUE 


Initial! 

ze : 

v(l) 

- 

i. 

2 BAD  = 

0 

v ( 2 ) 

= 

i. 

KB 

0 

v { 3 ) 

= 

i. 

KB0 

0 

v ( 4 ) 

= 

i. 

ARG 

0 

v 5 

= 

i 

JB 

= 

i 

TEN 

= 

10. 
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APPENDIX  J 

PROBABILITY  OF  EFFECTIVELY  SIMULTANEOUS  FAILURE  OF 
TWO  GYROS  AND  IMPACT  ON  FAILURE  ISOLATION  AND 


SYSTEM  FAILURE 
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Probability  of  Effectively  Simultaneous  Failure  of  Two  Gyros  and 
Impact  on  Failure  Isolation  and  System  Failure 

On  missions  where  two  gyros  failed  during  a half  hour 
period,  the  probability  the  failures  occurred  within  60  seconds 
of  each  other  is  PgF  - 60/1800  = 0.033.  Since  testing  involves 
a smoothing  time,  two  failures  within  60  seconds  can  involve 
testing  in  the  presence  of  effectively  simultaneous  failures. 

To  see  the  impact  of  simultaneous  failures  on  testing  substitute 
(6c)  of  Appendix  I for  say  gyro  No.  1 and  No.  2 failed  into  (6a) , 
(6b)  to  obtain  an  algebraic  reduction  the  test  functions  Fr  of 
the  sophisticated  procedure: 


4 

3 


O 


4 

3 


Dpr  = failure  drifts 


6r  = angle  of  drift 


F = — D D C r 

4 3 F11JF2L'e1+30oL'e2+30o 


Say  Dpi  > Dp2>  Dp 
Note  that  testing 
No.  1 failure  is 


where  D_  is 
MIN  2 Fmin 

> e where  e = 

unsuccessful  if  Dp 


the  minimum  rate  for  failure, 

DP  /2  for  detection  of  qyro 
r MIN  ^ 

satisfies 


J-2 
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> 


_3_ 

4A 


usually  when  D < D < D 

* MIN  or  2 FMAX 


where 


A “ ceJ  ‘ coJ 


i*  = e - 30°  , o*  = e2  - 30° 


it  it 

The  probability  given  G^,  82  that  the  drift  rate  satisfies 

S dfi  < ^ df  1 is; 


PD  ' 


HI"':  . 3 (!  - of  - K 


/D_ 

- D \ 

' 8 

/ D_, 

( fmax 

tMlNj 

( * MAX 

fmin) 

2 2 

* *•  it*- 

where  0^  + 02  < 2/3,  assuming  a flat  distribution  of  failure 

drift  rates.  It  is  believed  that  the  actual  distribution  of 
failure  rates  is  a combination  of  two  flat  distributions  of  0.5 
area  each  in  the  ranges  l.°/hr  to  20.°/hr  and  20°/hr  - 100°/sec 
( 360 , 000°/hr) , in  which  case  failures  of  near  equal  magnitude 
practically  always  occur  in  the  range  l.°/hr  to  20.°/hr  with  half 
the  probability  for  a single  flat  distribution. 

The  probability  that  gyro  No.  1 will  not  be  isolated  by 
test  is 


F , PASS 


th 

2 TT 


i: 


d0 . 


2 *4 
h ~ °2 
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where 


8a 

27tt 


2 


Dt 


90/ D 


(df  - °F  ) 

\ MAX  MIN/ 


averaging  with  respect  to  Dt 


F^PASS  180 


for  Dp 


> > 


The  fraction  of  flights  where  two  failures 


occurre§Xin  whicA^non-isolation  of  the  larger  failure  rate 
resulted  from  simultaneous  failures  is 
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p =p  *P  =1.8x10 

PG  SF  FjPASS 


-4 


Non-detection  probability 
of  greater  failure 


The  probability  that  the  gyro  which  failed  with  a lesser  drift 
rate  is  not  detected  may  be  shown  to  be 


L 2 


df  - § df 

MAX  2 

p;  ^ \ 

\ MAX  MIN/ 


Non-detection  probability 
of  lesser  failure 


On  average,  for  -r-  D > D > D 

J MAX  2 MIN 


L 4 


(df  " J df  ) 

\ MAX  MIN/ 

(°f  °f  y* 

\ MAX  MIN/ 


_1_ 

4 


for  Dp  >>  Dp  »,•  Thus  about  25%  of  the  cases  of  dual  failures 
r MAX  MIN 

the  lesser  failure  is  not  detected  by  its  Fr  test. 

Tests  Fr  with  dual  failure  not  involving  r can  fail.  The 
average  value  of  positive  cases,  which  occur  50%  of 

the  time  is 


F 


3 


2 


(df  + df  ’ 

V MAX  MIN) 

.2 

l 2 

7T 

(df  + °F  ) 

\ MAX  MIN  / 

2 

4.45  J 
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Comparing  with  a test  level 


it  is  clear  that  almost  half  the  time  (when  sign  of  F3  positive) 
it  will  fail  the  test. 

Consider  the  probability  that  no  test  fails,  F < t2 

r r 

- 1'  2,3,  4) , in  the  dual  failure  case.  The  probability 
r ~ ^ Passes  is  1/180,  that  r = 2 passes  is  near  1,  in  this 
case,  while  the  probabilities  of  r = 3 pass  or  r = 4 pass  are 
near  equal  as 


- 2P-) 

rPASS  \l  rad/ 


where  9,  = 


l 2 Id 


AVERAGE 


r - 3,4 


1.3  x 10 


for  Df  = 40  D 

MAX  MIN 


Then  the  probability  of  system  failure  because  no  test  fails  is 


SYS  FAILURE 
ALL  PASS 


(l8o)  ( 1 •°)f  1-  3 X 10 


-n  = io-8 
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In  the  extremely  likely  case  one  or  more  Fr  tests  fail,  it  is 
proposed  that  dual  failures  be  handled  as  follows.  For  four 
gyros,  if  a test  Fr  failed,  make  the  three  gyro  test  not  using 
gyro  r*  and  if  any  test  fails  conclude  that  dual  failure  has 
occurred . 

In  the  event  of  deciding  that  dual  failure  has  occurred, 
revert  to  the  simple  test  procedure 


If  only  one  test  passes,  Tr*s*  < c,  it  is  concluded  gyro  r*  and 
gyro  s*  are  good  and  that  the  remaining  gyros  are  bad,  a certain 
conclusion.  If  two  tests  pass,  T r*s*  and  having  a gyro 

in  common  then  conclude  certainly  that  r*  is  good  and  the  fourth 
gyro  p*  is  bad  {since  either  s*  gyro  or  q*  gyro  is  good  and  it  is 
known  two  gyros  are  bad) , thus  reducing  the  situation  to  the 
ambiguous  case  of  three  gyros,  r* , s*,  q*  where  p*  is  known  bad, 
r*  is  known  good  but  s*  gyro  or  q*  gyro  is  bad  with  calculable 
probability  based  on  the  magnitude  of  l^*r*s*l  an<^  ^r*q*  ^ 
probability  of  a test  passing  given  that  two  GF2  failures 
occurred  is  : 


df 

- MIN 

/ Df 

/ MAX  1 

dDF 

Pass 

Probability 

PPASS , 1 BAD 

71 

J 

L * 

/D  F 

\ MAX 

df  \ 
MIN/ 

if  either 
gyro  r or 

MIN 

gyro  s 
failed 

*D  = 20 . 

max 

GF^  failure 

D . for  a 
min 

occurs  so 

range  l.°/hr  - 
we  may  usually 

20.°/hr,  but  half  the  time 

take  D = 40  D . and  get 

max  min 

^correct  results. 

Using  notation  defined  in  5.3.3  on  attitude  rate  failure. 
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fmin 

7T 


PPASS , 2 BAD 


dDT 


(DI 


- D„ 


MAX 


MIN 


if  both 
gyro  r or 
gyro  s 
failed 


F 

MIN 

2 TT 


Only  the  case  where  a test  with  both  gyros  bad  has  |t  | < l 
leads  to  system  failure  directly  associated  with  simultaneity  of 
failures  of  two  gyros,  having  probability  within  the  subclass  of 
missions  in  which  two  gyro  failures  occurred: 


PSYSTEM 

FAILURE 


SF 


0 . 33 


P 


PASS, 2 BAD 


Probability  of  system  failure 
due  to  simultaneous  failure  of 
2 gyros.  Given:  2 gyros 

failed  during  mission 


F 

MIN 

2 TT 


\ MIN/ 
DF 

MAX 


= 0,8  x 10 


using  D 

FMAX 


20  D 

MIN 
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